CVE-1999-1022
MediumExploitation Probability (EPSS)
Elevated risk52th percentile - higher than 52% of all known CVEs
Summary
The serial_ports administrative program in IRIX 4.x and 5.x trusts the user's PATH environmental variable to find and execute the ls program, allowing local users to gain root privileges via a Trojan horse ls program.
Risk Assessment
Local users can exploit this vulnerability to gain unauthorized access to the system with administrator privileges, posing a serious security threat to the organization.
Recommendation
It is recommended to limit trust in the PATH variable and implement access controls on administrative programs to prevent the execution of malicious software.
Original NVD description (English source)
serial_ports administrative program in IRIX 4.x and 5.x trusts the user's PATH environmental variable to find and execute the ls program, which allows local users to gain root privileges via a Trojan horse ls program.