CVE-1999-1142 in SunOS
Summary
by MITRE
SunOS 4.1.2 and earlier allows local users to gain privileges via "LD_*" environmental variables to certain dynamically linked setuid or setgid programs such as (1) login, (2) su, or (3) sendmail, that change the real and effective user ids to the same user.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 04/16/2026
This vulnerability exists in SunOS 4.1.2 and earlier versions where certain dynamically linked setuid or setgid programs fail to properly sanitize environment variables, specifically the LD_* variables that control dynamic linker behavior. The flaw allows local users to manipulate these environment variables to execute arbitrary code with elevated privileges, effectively bypassing the intended security controls that should prevent privilege escalation.
The technical implementation of this vulnerability stems from the improper handling of dynamic linker environment variables within setuid programs. When programs like login, su, or sendmail execute with elevated privileges, they inherit the environment variables from the calling process. The LD_* variables such as LD_LIBRARY_PATH, LD_PRELOAD, and similar environment variables are processed by the dynamic linker to determine which shared libraries to load and in what order. When these variables contain malicious paths or libraries, the dynamic linker will load attacker-controlled code instead of the legitimate system libraries.
The operational impact of this vulnerability is significant as it provides local users with a straightforward method to escalate privileges from regular user level to root or another user's privileges. This occurs because the vulnerable programs change the real and effective user ids to the same user, but the environment variable manipulation allows the attacker to inject malicious code that executes with the elevated privileges of the setuid program. The attack vector is particularly dangerous because it requires no network access and can be executed locally by any user with access to the system.
This vulnerability aligns with CWE-276, which describes improper privilege management, and specifically relates to CWE-426, which addresses untrusted search path or hardcoded library path. The attack pattern follows techniques described in the MITRE ATT&CK framework under T1068, which covers privilege escalation through exploitation of environment variables and T1548.1, which covers abuse of setuid/setgid binaries. The vulnerability demonstrates a classic case of environment variable contamination that can be exploited to execute arbitrary code with elevated privileges.
The recommended mitigations include implementing proper environment variable sanitization within setuid programs to remove or neutralize LD_* variables before executing privileged operations. System administrators should also ensure that all setuid programs are properly configured and that environment variables are validated or cleared before privilege escalation occurs. Additionally, upgrading to SunOS versions that properly handle environment variables in setuid contexts would eliminate this vulnerability. The implementation of secure coding practices that prevent environment variable contamination in privileged contexts is essential to prevent similar issues in other software components. Regular security audits should verify that setuid programs properly handle environment variables and that no attacker-controlled libraries can be loaded during program execution.