PT-1998-1128 · Oracle · Nis++2

Published 1998-11-12 · Updated 2018-10-30 · CVE-1999-1025

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions CDE screen lock program (screenlock) on Solaris version 2.6

Description The issue concerns the CDE screen lock program, which fails to properly lock an unprivileged user's console session when the host is an NIS+ client. This allows others with physical access to login with any string, potentially compromising the security of the system.

Recommendations For Solaris 2.6, consider disabling the CDE screen lock program until a proper fix is available, or ensure that physical access to the console is restricted to authorized personnel to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-1999-1025

Affected Products

Cde Screen Lock Program

Nis+

Solaris

References · 4

• http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fpatches%2F106027&zone_32=411568%2A%20 · Vendor Advisory
• http://securityfocus.com/bid/294 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-1999-1025 · Security Note
• http://marc.info/?l=bugtraq&m=90831127921062&w=2 · Note