CVE-1999-1138

SCO UNIX System V/386 Release 3.2, and other SCO products, installs the home directories (1) /tmp for the dos user, and (2) /usr/tmp for the asg user, which allows other users to gain access to those accounts since /tmp and /usr/tmp are world-writable.

CVSS v2.0 10.0 HIGH

10.0^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 10.0 / Impact : 10.0

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://www.cert.org/advisories/CA-1993-13.html	US Government Resource
https://exchange.xforce.ibmcloud.com/vulnerabilities/546

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:sco:open_desktop:1.0:::::::*
	cpe:2.3:o:sco:open_desktop:2.0:::::::*
	cpe:2.3:o:sco:open_desktop:3.0:::::::*
	cpe:2.3:o:sco:open_desktop_lite:3.0:::::::*
	cpe:2.3:o:sco:openserver:3.0:::::::*
	cpe:2.3:o:sco:unix:system_v386_3.2_operating_system:::::::*
	cpe:2.3:o:sco:unix:system_v386_3.2_operating_system_2.0:::::::*
	cpe:2.3:o:sco:unix:system_v386_3.2_operating_system_4.0:::::::*
	cpe:2.3:o:sco:unix:system_v386_3.2_operating_system_4.x:::::::*

History

No history.

Information

Published : 1993-09-17 04:00

Updated : 2023-12-10 10:17

NVD link : CVE-1999-1138

Mitre link : CVE-1999-1138

CVE.ORG link : CVE-1999-1138

JSON object : View

Products Affected

sco

openserver
open_desktop
unix
open_desktop_lite

CWE

NVD-CWE-Other

{"id": "CVE-1999-1138", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 10.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": true, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "1993-09-17T04:00:00.000", "references": [{"url": "http://www.cert.org/advisories/CA-1993-13.html", "tags": ["US Government Resource"], "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/546", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "SCO UNIX System V/386 Release 3.2, and other SCO products, installs the home directories (1) /tmp for the dos user, and (2) /usr/tmp for the asg user, which allows other users to gain access to those accounts since /tmp and /usr/tmp are world-writable."}], "lastModified": "2017-10-10T01:29:02.797", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:sco:open_desktop:1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4624BE70-B14C-470A-B0ED-133FAE688882"}, {"criteria": "cpe:2.3:o:sco:open_desktop:2.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F2A765EC-A399-494A-A644-338FB2F014ED"}, {"criteria": "cpe:2.3:o:sco:open_desktop:3.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0AD2701A-E930-4F4D-85F7-02F80135E34E"}, {"criteria": "cpe:2.3:o:sco:open_desktop_lite:3.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E1DFB7EF-5D8E-4BA9-A543-3997FA4DC433"}, {"criteria": "cpe:2.3:o:sco:openserver:3.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7363FF35-7C67-40DC-AD38-74FD6264BF5A"}, {"criteria": "cpe:2.3:o:sco:unix:system_v386_3.2_operating_system:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BFE6762F-886D-4FC9-8AE5-C462BF42E403"}, {"criteria": "cpe:2.3:o:sco:unix:system_v386_3.2_operating_system_2.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "02948256-49AE-415E-8B64-27DA246B7A57"}, {"criteria": "cpe:2.3:o:sco:unix:system_v386_3.2_operating_system_4.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1005628A-0E07-485C-9E88-353A86E83BD0"}, {"criteria": "cpe:2.3:o:sco:unix:system_v386_3.2_operating_system_4.x:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "207FB7B7-C6FF-4D9F-9E6D-34E6CF7E2146"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}