CVE-1999-1386

MediumCVSS 5.5/10Last modified Jun 16, 2026

Description

Perl 5.004_04 and earlier follows symbolic links when running with the -e option, which allows local users to overwrite arbitrary files via a symlink attack on the /tmp/perl-eaXXXXX file.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-59

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://marc.info/?l=bugtraq&m=88932165406213&w=2Exploit, Mailing List
http://www.iss.net/security_center/static/7243.phpBroken Link
http://www.redhat.com/support/errata/rh50-errata-general.html#perlBroken Link
http://marc.info/?l=bugtraq&m=88932165406213&w=2Exploit, Mailing List
http://www.iss.net/security_center/static/7243.phpBroken Link
http://www.redhat.com/support/errata/rh50-errata-general.html#perlBroken Link

Timeline

Published: Dec 31, 1999
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 1999

CVE-1999-13934.6Control Panel "Password Security" option for Apple Powerbooks allows attackers with physical access to the machine to bypass the security by CVE-1999-13942.1BSD 4.4 based operating systems, when running at security level 1, allow the root user to clear the immutable and append-only flags for file CVE-1999-13977.5Index Server 2.0 on IIS 4.0 stores physical path information in the ContentIndex\Catalogs subkey of the AllowedPaths registry key, whose per CVE-1999-14002.1The Economist screen saver 1999 with the "Password Protected" option enabled allows users with physical access to the machine to bypass the CVE-1999-140510.0snap command in AIX before 4.3.2 creates the /tmp/ibmsupt directory with world-readable permissions and does not remove or clear the directo CVE-1999-14125.0A possible interaction between Apple MacOS X release 1.0 and Apache HTTP server allows remote attackers to cause a denial of service (crash)CVE-1999-14147.2IBM Netfinity Remote Control allows local users to gain administrator privileges by starting programs from the process manager, which runs w CVE-1999-14185.0ICQ99 ICQ web server build 1701 with "Active Homepage" enabled generates allows remote attackers to determine the existence of files on the CVE-1999-14227.2The default configuration of Slackware 3.4, and possibly other versions, includes . (dot, the current directory) in the PATH environmental v CVE-1999-14302.1PIM software for Royal daVinci does not properly password-protext access to data stored in the .mdb (Microsoft Access) file, which allows lo CVE-1999-14314.6ZAK in Appstation mode allows users to bypass the "Run only allowed apps" policy by starting Explorer from Office 97 applications (such as W CVE-1999-14405.1Win32 ICQ 98a 1.30, and possibly other versions, does not display the entire portion of long filenames, which could allow attackers to send