PT-1998-1214 · Oracle · Solaris

Published 1998-07-16 · Updated 2018-10-30 · CVE-1999-1432

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Solaris versions 2.4 through 2.6

Description The issue concerns power management on Solaris, where the xlock process does not start until after the sys-suspend has completed. This allows an attacker with physical access to input characters to the last active application from the keyboard for a short period after the system is restoring, potentially leading to increased privileges.

Recommendations For Solaris versions 2.4 through 2.6, consider implementing a workaround to start the xlock process immediately after sys-suspend to prevent unauthorized keyboard input. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-1999-1432

Affected Products

Solaris

References · 4

• 🔥 https://exploit-db.com/exploits/19126 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-1999-1432 · Security Note
• http://securityfocus.com/bid/160 · Note
• http://marc.info/?l=bugtraq&m=90221104525997&w=2 · Note