CVE-1999-0046
published 1997-02-06CVE-1999-0046: Buffer overflow of rlogin program using TERM environmental variable.
PriorityP346critical10CVSS 2.0
AVNACLAuNCCICAC
EXPLOIT
EPSS
51.88%
99.0th percentile
Buffer overflow of rlogin program using TERM environmental variable.
Affected
39 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| bsdi | bsd_os | — | — |
| bsdi | bsd_os | — | — |
| bsdi | bsd_os | — | — |
| bsdi | bsd_os | — | — |
| debian | debian_linux | — | — |
| freebsd | freebsd | — | — |
| freebsd | freebsd | — | — |
| freebsd | freebsd | — | — |
| freebsd | freebsd | — | — |
| freebsd | freebsd | — | — |
| hp | hp-ux | — | — |
| hp | hp-ux | — | — |
| hp | hp-ux | — | — |
| hp | hp-ux | — | — |
| hp | hp-ux | — | — |
| hp | hp-ux | — | — |
| hp | hp-ux | — | — |
| hp | hp-ux | — | — |
| hp | hp-ux | — | — |
| hp | hp-ux | — | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
Detection & IOCsextracted from sources · hover to see the quote
bytes↗
\x24\x0f\x12\x34
- →Detect MIPS IRIX shellcode NOP sled pattern: repeated 4-byte sequence 0x240f1234 in the TERM environment variable passed to rlogin. ↗
- →The exploit targets the SUID rlogin binary; alert on rlogin spawning a shell (/bin/sh) as root, indicating successful privilege escalation. ↗
- →Look for the LAST STAGE OF DELIRIUM exploit signature string in process environment or memory: 'copyright LAST STAGE OF DELIRIUM oct 1997 poland //lsd-pl.net/' ↗
- ·The exploit specifically targets IRIX 5.2, 5.3, 6.2, 6.3 on specific IP hardware platforms; the hardcoded address offset (jump()+10288+7000) is platform-specific and will not work on other architectures without modification. ↗
- ·The vulnerability was later updated to include additional IRIX versions; detection rules should not be limited to the originally listed platforms. ↗
- ·Similar buffer overflow bugs exist in some telnetd implementations via the TERM variable; detection logic for oversized TERM values should be applied to telnetd as well. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No writeups or analysis indexed.
CAPEC
Buffer Overflow via Environment Variables
mitre_capec
[HIGH] Buffer Overflow via Environment Variables
CAPEC-10: Buffer Overflow via Environment Variables
This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the adversary finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.
Execution Flow:
Step 1 [Explore]: [Identify target application] The adversary identifies a target application or program to perform the buffer overflow on. In this attack the adversary looks for an application that loads the content of an environment variable into a buffer.
Step 2 [Experiment]: [Find injection vector] The adversary identifies an injection vector to deliver the excessive content to the targeted application's buffer.
Technique: Chang
CWE
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
mitre_cwe
CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.
Modes of Introduction:
Phase: Implementation
Common Consequences:
Scope: Integrity, Confidentiality, Availability. Impact: Modify Memory, Execute Unauthorized Code or Commands. Buffer overflows often can be used to execute arbitrary code, which is usually outside the scope of the product's implicit security policy. This can often be used to subvert any other security service.
Scope: Availability. Impact: Modify Memory, DoS: Crash, Exit, or Restart, DoS: Resource Consumption (CPU). Buffer overflows generally lead to crashes. Other attacks leading to lack of ava
1997-02-06
Published