CVE-1999-1413
MediumExploitation Probability (EPSS)
Low risk49th percentile - higher than 49% of all known CVEs
Summary
In Solaris 2.4 before kernel jumbo patch -35, set-gid programs can dump core even if the real user id is not in the set-gid group. This allows local users to overwrite or create files with higher privileges.
Risk Assessment
Local users may exploit this vulnerability to gain unauthorized access to files and system resources, potentially leading to serious security breaches.
Recommendation
It is recommended to apply kernel jumbo patch -35 to eliminate this vulnerability and to monitor the system for unauthorized activities.
Original NVD description (English source)
Solaris 2.4 before kernel jumbo patch -35 allows set-gid programs to dump core even if the real user id is not in the set-gid group, which allows local users to overwrite or create files at higher privileges by causing a core dump, e.g. through dmesg.