CVE-1999-1347 in Linux
Summary
by MITRE
Xsession in Red Hat Linux 6.1 and earlier can allow local users with restricted accounts to bypass execution of the .xsession file by starting kde, gnome or anotherlevel from kdm.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 04/19/2026
The vulnerability described in CVE-1999-1347 represents a significant security flaw in the Xsession handling mechanism of Red Hat Linux 6.1 and earlier versions. This issue specifically targets the desktop environment initialization process where user sessions are managed through the .xsession file that typically contains critical startup commands and configurations. The flaw allows local users with restricted accounts to circumvent the normal session execution flow and bypass the execution of their designated .xsession file through a specific method involving kdm, the KDE Display Manager.
The technical implementation of this vulnerability stems from how the Xsession system handles authentication and session management when users log in through kdm. When users attempt to start desktop environments such as KDE or GNOME, the system fails to properly validate or enforce the execution of the user's configured .xsession file. This creates a path where malicious or unauthorized actions can be performed without the normal security checks that should occur during session initialization. The vulnerability essentially allows privilege escalation through session manipulation rather than traditional authentication bypass methods.
From an operational impact perspective, this vulnerability enables local users to potentially execute arbitrary commands or access system resources that should normally be restricted. The bypass mechanism works by leveraging the display manager's session handling capabilities to start alternative desktop environments without proper authentication or session validation. This creates a security gap where users can gain access to system resources or execute commands that would normally be restricted within their normal session context. The vulnerability particularly affects systems where users have restricted accounts but still need access to graphical desktop environments.
The weakness in this vulnerability aligns with CWE-284, which describes improper access control in software systems. The flaw represents a failure in access control mechanisms where the system does not properly enforce session boundaries and execution contexts. From an ATT&CK framework perspective, this vulnerability maps to privilege escalation techniques and potentially to defense evasion methods where users can bypass normal security controls. The attack vector involves leveraging legitimate system components to execute unauthorized actions, which aligns with techniques described in the ATT&CK matrix for bypassing security controls.
Mitigation strategies for this vulnerability should focus on updating to patched versions of Red Hat Linux where the session handling mechanisms have been corrected. System administrators should ensure that kdm and related display manager components are properly configured to enforce session boundaries and execute user .xsession files as intended. The recommended approach includes implementing proper session validation mechanisms, ensuring that all desktop environment startups go through the proper authentication and execution paths, and maintaining updated security configurations that prevent unauthorized bypass of session initialization. Additionally, monitoring systems should be implemented to detect unusual session startup patterns that might indicate exploitation attempts of this vulnerability.