# CVE-1999-1506: Sun Microsystems SunOS Sendmail unauthorized access to bin account

Source: https://junglewise.ai/threats/cve-1999-1506-sun-microsystems-sunos-sendmail-unauthorized-access-to-bin-account  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 1990-01-29. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-1999-1506 · Severity: high · CVSS 7.5 · Published 1990-01-29

A vulnerability in the Sendmail mail server on older SunOS systems allows remote attackers to gain unauthorized access to the 'bin' user account. Sendmail is a critical service responsible for routing and delivering email across a network. Successful exploitation could allow an attacker to manipulate system files or use the compromised account as a stepping stone for further attacks on the organization's infrastructure.

Vendors: [Sun Microsystems](https://junglewise.ai/threats/vendors/sun-microsystems).

## Quick answers

**Is CVE-1999-1506 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-1999-1506 being exploited in the wild.

**How severe is CVE-1999-1506?** High severity, with a CVSS score of 7.5, published 29 January 1990.

**Which products and versions are affected?** Sun Microsystems Sendmail (SMI) 4.0 and earlier.

**Is there a fix for CVE-1999-1506?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-1999-1506 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-1999-1506?** Check whether you run Sun Microsystems Sendmail (SMI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in the SMI (Sun Microsystems, Inc.) version of Sendmail 4.0 and earlier running on SunOS versions up to 4.0.3. The flaw allows a remote, unauthenticated attacker to gain access to the 'bin' user account via the network. While the specific root cause (e.g., buffer overflow or configuration error) is not detailed in the legacy advisory, the impact is a partial loss of confidentiality, integrity, and availability. Attackers can leverage this access to interact with system binaries and potentially escalate privileges. Patches were historically provided by the vendor to address this issue.

## Affected products

- Sun Microsystems SunOS up to 4.0.3
- Sun Microsystems Sendmail (SMI) 4.0 and earlier

## Timeline

- 1990-01-29: advisory: Initial advisory published by CERT/CC and NVD

## References

- [http://www.cert.org/advisories/CA-90.01.sun.sendmail.vulnerability](http://www.cert.org/advisories/CA-90.01.sun.sendmail.vulnerability)
- [http://www.securityfocus.com/bid/6](http://www.securityfocus.com/bid/6)