What is CVE-1999-1554?

CVE-1999-1554 is a publicly disclosed cybersecurity vulnerability identified by the CVE database. It has a LOW severity rating with a CVSS score of 2.1.

How to search for CVE vulnerabilities?

You can search the 4nuxd CVE database using CVE IDs, vendor names, product names, or severity levels to find detailed vulnerability information and exploit details.

CVE-1999-1554

Source: cve@mitre.org

LOW

2.1

Published: October 31, 1990 at 05:00 AM

Modified: April 3, 2025 at 01:03 AM

Vulnerability Description

/usr/sbin/Mail on SGI IRIX 3.3 and 3.3.1 does not properly set the group ID to the group ID of the user who started Mail, which allows local users to read the mail of other users.

CVSS Metrics

Base Score

2.1

Severity

LOW

Vector String

AV:L/AC:L/Au:N/C:P/I:N/A:N

Weaknesses (CWE)

NVD-CWE-Other

Source: nvd@nist.gov

AI Security Analysis

01 // Technical Summary

Local privilege escalation is possible on SGI IRIX 3.3 and 3.3.1 due to a flaw in the Mail program. This vulnerability allows any local user to read the mailboxes of other users by exploiting an improper group ID setting, leading to unauthorized information disclosure.

02 // Vulnerability Mechanism

Step 1: User Login: A local user logs into the vulnerable SGI IRIX system.

Step 2: Mail Execution: The user executes the /usr/sbin/Mail program.

Step 3: Group ID Flaw: The Mail program fails to correctly set its effective group ID to the user's group ID.

Step 4: File Access: Because of the incorrect group ID, Mail accesses mail files with the wrong permissions.

Step 5: Mailbox Reading: The user can read the mailboxes of other users, as the mail files are accessible due to the incorrect group ID.

03 // Deep Technical Analysis

The vulnerability stems from a failure in the Mail program to correctly set the effective group ID to the group ID of the user launching the application. Specifically, when Mail is executed, it should set its effective group ID to the user's group ID to ensure proper file permissions for accessing mail files. However, in IRIX 3.3 and 3.3.1, this step is omitted or implemented incorrectly. This means that Mail runs with the default group ID, which may grant access to files (including mail files) that should be restricted. The root cause is a missing or incorrect call to setegid() or a similar function to set the effective group ID. This allows a user to read other users' mailboxes because the mail files are likely group-readable, and Mail runs with a group ID that grants access.

04 // Exploitation Status

This vulnerability is a **Discovery Only** vulnerability. While the concept is straightforward, the specific exploit code would be highly dependent on the IRIX environment and file permissions. No public PoC is available, but the vulnerability is easily reproducible with the right environment.

05 // Threat Intelligence

This vulnerability is not associated with any specific APTs or malware campaigns due to its age and the limited use of the affected operating system. It is not listed in the CISA KEV catalog.

06 // Detection & Hunting

Review system logs for unusual access patterns to mail files (e.g., access by users other than the owner).
Monitor file access events using tools like auditd (if available) to detect unauthorized access to mail files.
Analyze process execution logs to identify instances where /usr/sbin/Mail is run and its effective group ID.
Check file permissions of mail files to ensure they are not group-readable.

07 // Remediation & Hardening

Upgrade to a patched version of IRIX (if available).
If upgrading is not possible, restrict access to the /usr/sbin/Mail program using file permissions (e.g., only allow the root user to execute it).
Ensure that mail files are not group-readable. Set appropriate file permissions (e.g., owner-only read/write) for mail files.
Implement a security audit to review file permissions and user access rights.
Consider using a different mail client or service if possible.