CVE-1999-0062
HighExploitation Probability (EPSS)
Low risk43th percentile - higher than 43% of all known CVEs
Summary
The chpass command in OpenBSD allows a local user to gain root access through file descriptor leakage.
Risk Assessment
Exploitation of this vulnerability could lead to unauthorized access to the system, posing a serious security threat to the organization.
Recommendation
It is recommended to update the OpenBSD system and monitor access to the chpass command to minimize risk.
Other vulnerabilities in OpenBSD
See all- CVE-2017-1000372Critical
A flaw exists in OpenBSD's implementation of the stack guard page that allows attackers to bypass it resulting in arbitrary code execution using setuid binaries such as /usr/bin/at. This affects OpenBSD 6.1 and possibly earlier versions.
- CVE-2026-56101Medium
OpenBSD before commit 1ee99df contains an inverted comparison vulnerability in the ieee80211_michael_mic_failure() function within sys/net80211/ieee80211_crypto_tkip.c that allows unauthenticated attackers within RF range to trigger denial of service by sending two malformed TKIP frames separated by more than 60 seconds. Attackers can exploit the reversed TKIP MIC failure countermeasure window check to deauthenticate all associated TKIP stations and block reassociation for up to 90 seconds, while within-window MIC failures that should engage countermeasures are silently discarded, leaving key-recovery attempts undetected.
- CVE-2026-57589High
In the OpenBSD kernel up to version 7.9, a use-after-free vulnerability exists in sys/kern/sysv_sem.c, allowing local privilege escalation to root. The issue occurs after a context switch following the tsleep call in sys_semget().
- CVE-2026-56099Medium
A vulnerability in OpenBSD before commit 6a23123 (2026-06-18) in the mpls_do_error function within sys/netmpls/mpls_input.c allows remote attackers to read kernel stack memory by sending crafted MPLS frames with 16 labels and no Bottom-of-Stack bit set.
- CVE-2026-55706Medium
In OpenBSD before commit 076e2b1, the sppp_pap_input function in sys/net/if_spppsubr.c allows authentication bypass via certain zero values for lengths.
- CVE-2023-40216Medium
OpenBSD 7.3 before errata 014 is missing an argument-count bounds check in console terminal emulation. This could cause incorrect memory access and a kernel crash after receiving crafted DCS or CSI terminal escape sequences.
- CVE-2000-0914Medium
OpenBSD 2.6 and earlier allows remote attackers to cause a denial of service by flooding the server with ARP requests.
- CVE-1999-0481Medium
CVE-1999-0481 vulnerability concerns the 'poll' service in OpenBSD, which can lead to a denial of service.
- CVE-1999-0485Low
Remote attackers can cause a system crash through ipintr() in ipq in OpenBSD.
Original NVD description (English source)
The chpass command in OpenBSD allows a local user to gain root access through file descriptor leakage.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS