How severe is CVE-1999-1468?

CVE-1999-1468 has a CVSS 2.0 base score of 6.2, rated medium severity.

Is CVE-1999-1468 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (26th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-1999-1468?

CVE-1999-1468 primarily affects Next. In total, 15 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-1999-1468?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-1999-1468 published?

CVE-1999-1468 was published on 1991-10-22 and last updated on 2026-06-16.

CVE-1999-1468

CVE-1999-1468 is a medium-severity vulnerability in Next with a CVSS 2.0 base score of 6.2. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Severity: Medium (CVSS 2.0 base score 6.2)
EPSS exploit prediction: 0% (26th percentile)
Actively exploited: Not listed in CISA KEV
Affected product: Next
Published: 1991-10-22
Last modified: 2026-06-16

Description

rdist in various UNIX systems uses popen to execute sendmail, which allows local users to gain root privileges by modifying the IFS (Internal Field Separator) variable.

Frequently asked questions

What is CVE-1999-1468?: rdist in various UNIX systems uses popen to execute sendmail, which allows local users to gain root privileges by modifying the IFS (Internal Field Separator) variable.
How severe is CVE-1999-1468?: CVE-1999-1468 has a CVSS 2.0 base score of 6.2, rated medium severity.
Is CVE-1999-1468 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (26th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-1999-1468?: CVE-1999-1468 primarily affects Next. In total, 15 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-1999-1468?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-1999-1468 published?: CVE-1999-1468 was published on 1991-10-22 and last updated on 2026-06-16.

References

Affected products (15)

cpe:2.3:a:next:next:2.0:*:*:*:*:*:*:*
cpe:2.3:a:next:next:2.1:*:*:*:*:*:*:*
cpe:2.3:o:sgi:irix:3.3:*:*:*:*:*:*:*
cpe:2.3:o:sgi:irix:3.3.1:*:*:*:*:*:*:*
cpe:2.3:o:sgi:irix:3.3.2:*:*:*:*:*:*:*
cpe:2.3:o:sgi:irix:3.3.3:*:*:*:*:*:*:*
cpe:2.3:o:sgi:irix:4.0:*:*:*:*:*:*:*
cpe:2.3:o:cray:unicos:6.0:*:*:*:*:*:*:*
cpe:2.3:o:cray:unicos:6.0e:*:*:*:*:*:*:*
cpe:2.3:o:cray:unicos:6.1:*:*:*:*:*:*:*
cpe:2.3:o:sun:sunos:4.0.3:*:*:*:*:*:*:*
cpe:2.3:o:sun:sunos:4.0.3c:*:*:*:*:*:*:*
cpe:2.3:o:sun:sunos:4.1:*:*:*:*:*:*:*
cpe:2.3:o:sun:sunos:4.1.1:*:*:*:*:*:*:*
cpe:2.3:o:sun:sunos:4.1psr_a:*:*:*:*:*:*:*

More vulnerabilities in Next

CVE-1999-1193 — Critical (CVSS 10.0): The "me" user in NeXT NeXTstep 2.1 and earlier has wheel group privileges, which could allow the me user to use the su…
CVE-1999-1198 — High (CVSS 7.2): BuildDisk program on NeXT systems before 2.0 does not prompt users for the root password, which allows local users to…
CVE-1999-1392 — High (CVSS 7.2): Vulnerability in restore0.9 installation script in NeXT 1.0a and 1.0 allows local users to gain root privileges.
CVE-1999-1391 — High (CVSS 7.2): Vulnerability in NeXT 1.0a and 1.0 with publicly accessible printers allows local users to gain privileges via a…

All CVEs affecting Next →