Vulnerability CVE-1999-0126

Vulnerability Name:

CVE-1999-0126 (CCN-963)

Assigned:

1998-04-27

Published:

1998-04-27

Updated:

2008-09-09

Summary:

SGI IRIX buffer overflow in xterm and Xaw allows root access.

CVSS v3 Severity:

9.3 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)

Exploitability Metrics:	Attack Vector (AV): Local Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Changed
Impact Metrics:	Confidentiality (C): High Integrity (I): High Availibility (A): High

CVSS v2 Severity:

7.2 High (CVSS v2 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C)

Exploitability Metrics:	Access Vector (AV): Local Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete

7.2 High (CCN CVSS v2 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C)

Exploitability Metrics:	Access Vector (AV): Local Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete

Vulnerability Type:

CWE-Other

Vulnerability Consequences:

Gain Privileges

References:

Source: CCN
Type: Caldera International, Inc. Security Advisory SA-1998.05
Vulnerabilities in the XFree86 3.3 X servers

Source: CCN
Type: Caldera International, Inc. Security Advisory SA-1998.11
XFree86 3.3.1 Problems

Source: CCN
Type: The XFree86 Project, Inc. Security Advisory XFree86-SA-1998:01
xterm and Xaw library vulnerability

Source: CCN
Type: SGI Security Advisory 19981002-01-PX
xterm(1) exploitable buffer overflow

Source: CCN
Type: CIAC Information Bulletin J-010
SGI Buffer Overflow Vulnerabilities (xterm(1), Xaw library)

Source: MITRE
Type: CNA
CVE-1999-0126

Source: CCN
Type: CERT Vendor-Initiated Bulletin VB-98.04
Vulnerabilities in xterm and Xaw

Source: CCN
Type: CIAC Information Bulletin I-046
Open Group xterm and Xaw Library Vulnerabilities

Source: CIAC
Type: UNKNOWN
J-010

Source: XF
Type: UNKNOWN
xfree86-xterm-xaw(963)

Vulnerable Configuration:

Configuration 1:

cpe:/a:xfree86_project:xfree86:*:*:*:*:*:*:*:*

Configuration CCN 1:

cpe:/o:sgi:irix:5.2:*:*:*:*:*:*:*

OR cpe:/o:sgi:irix:5.3:*:*:*:*:*:*:*

OR cpe:/o:sgi:irix:6.0.1:*:*:*:*:*:*:*

OR cpe:/o:sgi:irix:6.1:*:*:*:*:*:*:*

OR cpe:/o:sgi:irix:6.2:*:*:*:*:*:*:*

OR cpe:/o:sgi:irix:6.3:*:*:*:*:*:*:*

OR cpe:/o:sgi:irix:6.4:*:*:*:*:*:*:*

OR cpe:/a:x.org:x11:*:*:*:*:*:*:*:*

OR cpe:/o:sgi:irix:6.5:*:*:*:*:*:*:*

OR cpe:/o:sgi:irix:6.0:*:*:*:*:*:*:*

OR cpe:/o:sgi:irix:4.0.5:*:*:*:*:*:*:*

OR cpe:/o:sgi:irix:4.0.1:*:*:*:*:*:*:*

OR cpe:/o:sgi:irix:4.0.1t:*:*:*:*:*:*:*

OR cpe:/o:sgi:irix:4.0.2:*:*:*:*:*:*:*

OR cpe:/o:sgi:irix:4.0.3:*:*:*:*:*:*:*

OR cpe:/o:sgi:irix:4.0.4:*:*:*:*:*:*:*

OR cpe:/o:sgi:irix:4.0.4b:*:*:*:*:*:*:*

OR cpe:/o:sgi:irix:4.0.4t:*:*:*:*:*:*:*

OR cpe:/o:sgi:irix:4.0.5_iop:*:*:*:*:*:*:*

OR cpe:/o:sgi:irix:4.0.5a:*:*:*:*:*:*:*

OR cpe:/o:sgi:irix:4.0.5b:*:*:*:*:*:*:*

OR cpe:/o:sgi:irix:4.0.5d:*:*:*:*:*:*:*

OR cpe:/o:sgi:irix:4.0.5e:*:*:*:*:*:*:*

OR cpe:/o:sgi:irix:4.0.5f:*:*:*:*:*:*:*

OR cpe:/o:sgi:irix:4.0.5g:*:*:*:*:*:*:*

OR cpe:/o:sgi:irix:4.0.5h:*:*:*:*:*:*:*

OR cpe:/o:sgi:irix:5.0.1:*:*:*:*:*:*:*

OR cpe:/o:sgi:irix:5.1:*:*:*:*:*:*:*

OR cpe:/o:sgi:irix:5.1.1:*:*:*:*:*:*:*

OR cpe:/o:sgi:irix:5.3:*:xfs:*:*:*:*:*

OR cpe:/o:sgi:irix:5.0:*:*:*:*:*:*:*

OR cpe:/o:sgi:irix:3.2:*:*:*:*:*:*:*

OR cpe:/o:sgi:irix:3.3:*:*:*:*:*:*:*

OR cpe:/o:sgi:irix:3.3.1:*:*:*:*:*:*:*

OR cpe:/o:sgi:irix:3.3.2:*:*:*:*:*:*:*

OR cpe:/o:sgi:irix:3.3.3:*:*:*:*:*:*:*

OR cpe:/o:sgi:irix:4.0:*:*:*:*:*:*:*

OR cpe:/o:sgi:irix:4.0.5_ipr:*:*:*:*:*:*:*

Denotes that component is vulnerable

Vulnerability Name:

CVE-1999-0126 (CCN-2096)

Assigned:

1998-04-27

Published:

1998-04-27

Updated:

1998-04-27

Summary:

Xaw is vulnerable to a buffer overflow caused by faulty processing of data related to specific X Windows resources. This buffer overflow could allow local users to gain unauthorized root privileges. This vulnerability can be exploited through a variety of applications linked to the Xaw library.

CVSS v3 Severity:

9.3 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)

Exploitability Metrics:	Attack Vector (AV): Local Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Changed
Impact Metrics:	Confidentiality (C): High Integrity (I): High Availibility (A): High

CVSS v2 Severity:

7.2 High (CVSS v2 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C)

Exploitability Metrics:	Access Vector (AV): Local Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete

7.2 High (CCN CVSS v2 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C)

Exploitability Metrics:	Access Vector (AV): Local Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete