CVE-1999-1022

Medium CVSS 6.2

Published 1994-10-02 · last changed 2026-06-16

The fix

We hold no Microsoft remediation data for CVE-1999-1022, which normally means it is not a Windows CVE. For non-Microsoft software the fix is the vendor's own updated release, and the affected versions are listed below.

What it is

serial_ports administrative program in IRIX 4.x and 5.x trusts the user's PATH environmental variable to find and execute the ls program, which allows local users to gain root privileges via a Trojan horse ls program.

Sources

NVD record for CVE-1999-1022

CVSS vector: AV:L/AC:H/Au:N/C:C/I:C/A:C