CVE-1999-0046

Description

Buffer overflow of rlogin program using TERM environmental variable.

Affected products

• bsdi / bsd_os1.1 – 1.1
• bsdi / bsd_os2.0 – 2.0
• bsdi / bsd_os2.0.1 – 2.0.1
• bsdi / bsd_os2.1 – 2.1
• debian / debian_linux0.93 – 0.93
• digital / ultrix
• FreeBSD / FreeBSD1.1.5.1 – 1.1.5.1
• FreeBSD / FreeBSD2.0 – 2.0
• FreeBSD / FreeBSD2.0.5 – 2.0.5
• FreeBSD / FreeBSD2.1.0 – 2.1.0
• FreeBSD / FreeBSD2.1.5 – 2.1.5
• HP / hp-ux10.00 – 10.00
• HP / hp-ux10.01 – 10.01
• HP / hp-ux10.08 – 10.08
• HP / hp-ux10.09 – 10.09
• HP / hp-ux10.10 – 10.10
• HP / hp-ux10.16 – 10.16
• HP / hp-ux10.20 – 10.20
• HP / hp-ux10.24 – 10.24
• HP / hp-ux10.30 – 10.30
• HP / hp-ux10.34 – 10.34
• ibm / aix3.2 – 3.2
• ibm / aix4.1 – 4.1
• ibm / aix4.1.1 – 4.1.1
• ibm / aix4.1.2 – 4.1.2
• ibm / aix4.1.3 – 4.1.3
• ibm / aix4.1.4 – 4.1.4
• ibm / aix4.1.5 – 4.1.5
• NetBSD / netbsd1.0 – 1.0
• NetBSD / netbsd1.1 – 1.1
• next / nextstep
• oracle / solaris
• oracle / solaris2.5.1 – 2.5.1
• oracle / solaris2.6 – 2.6
• oracle / solaris7.0 – 7.0
• oracle / solaris8 – 8
• sun / sunos4.1.3u1 – 4.1.3u1
• sun / sunos4.1.4 – 4.1.4
• sun / sunos5.3 – 5.3
• sun / sunos5.4 – 5.4
• sun / sunos5.5 – 5.5
• sun / sunos5.5.1 – 5.5.1

Exploits & proofs of concept

• exploit-dbBSD/OS 2.1 / DG/UX 4.0 / Debian 0.93 / Digital UNIX 4.0 B / FreeBSD 2.1.5 / HP-UX 10.34 / IBM AIX 4.1.5 / NetBSD 1.0/1.1 / NeXTstep 4.0 / SGI IRIX 6.3 / SunOS 4.1.4 - 'rlogin' Local Privilege Escalationby Roger Espel Llima

References

• MISChttps://exchange.xforce.ibmcloud.com/vulnerabilities/CVE-1999-0046