CVE-1999-1168 in Internet Security Scanner
Summary
by MITRE
install.iss installation script for Internet Security Scanner (ISS) for Linux, version 5.3, allows local users to change the permissions of arbitrary files via a symlink attack on a temporary file.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 04/18/2026
The vulnerability identified as CVE-1999-1168 resides within the installation script install.iss of the Internet Security Scanner (ISS) for Linux version 5.3, representing a classic symlink attack scenario that exploits improper handling of temporary files during the installation process. This flaw enables local users to manipulate file permissions of arbitrary files on the system by creating symbolic links that the installation script inadvertently follows, demonstrating a fundamental weakness in the script's security design and file handling procedures.
The technical implementation of this vulnerability stems from the installation script's failure to properly validate or secure temporary file creation processes. When the install.iss script executes, it creates temporary files without adequate safeguards against symbolic link attacks, allowing malicious local users to establish symbolic links with the same names as expected temporary files. This race condition vulnerability occurs because the script first checks for file existence and then creates the file, providing an opportunity for attackers to substitute their own symbolic links between these operations. The vulnerability directly maps to CWE-367, which describes the Time-of-Check to Time-of-Use (TOCTOU) race condition, and also aligns with CWE-276, which addresses improper file permissions and access control.
The operational impact of this vulnerability extends beyond simple permission manipulation, as local users can potentially escalate their privileges and gain unauthorized access to system resources. Attackers can exploit this weakness to modify critical system files, install malicious software, or create backdoors within the system. The vulnerability affects any local user with access to the system during the installation process, making it particularly dangerous in multi-user environments where privilege separation is not properly enforced. This weakness undermines the integrity of the installation process and can compromise the overall security posture of systems running the vulnerable ISS software. The attack vector is particularly concerning because it requires minimal privileges and can be executed without network access, making it a low-effort, high-impact security risk.
Mitigation strategies for CVE-1999-1168 should focus on implementing proper temporary file handling procedures that eliminate the race condition window. System administrators should ensure that the installation script creates temporary files with unique names and proper permissions, using techniques such as creating files with restricted permissions and verifying file ownership before processing. The recommended approach includes using secure temporary file creation methods that prevent symbolic link attacks, such as creating files in directories with restricted permissions and using atomic operations for file creation. Additionally, organizations should consider implementing the principle of least privilege during installation processes, ensuring that installation scripts run with minimal required permissions and that temporary files are properly secured throughout the installation lifecycle. This vulnerability also highlights the importance of following secure coding practices and conducting thorough security reviews of installation scripts and system utilities, particularly in environments where multiple users may have access to system resources.