CVE-1999-1384 in IRIX
Summary
by MITRE
Indigo Magic System Tour in the SGI system tour package (systour) for IRIX 5.x through 6.3 allows local users to gain root privileges via a Trojan horse .exitops program, which is called by the inst command that is executed by the RemoveSystemTour program.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 04/16/2026
The vulnerability described in CVE-1999-1384 represents a classic privilege escalation flaw within the SGI IRIX operating system's system tour package. This issue exists in the Indigo Magic System Tour component of the systour package, affecting IRIX versions 5.x through 6.3. The vulnerability stems from improper privilege handling during system tour removal operations, creating a path for local users to elevate their privileges to root level. The attack vector involves the exploitation of a Trojan horse program named .exitops that is executed during the removal process, demonstrating a significant weakness in the system's trust model and privilege management mechanisms.
The technical flaw manifests through the RemoveSystemTour program's execution of the inst command, which subsequently invokes the malicious .exitops program. This Trojan horse program is designed to be executed with elevated privileges, allowing an attacker to gain root access to the system. The vulnerability is particularly concerning because it operates at the system level where the inst command typically runs with administrative privileges. The .exitops program is placed in a location where it can be executed during the system tour removal process, exploiting the trust relationship between system components and the user executing the removal command. This represents a classic case of privilege escalation through insecure program execution and improper file permissions.
The operational impact of this vulnerability is severe as it allows any local user to gain complete system control without requiring authentication or specialized knowledge of system internals. Once exploited, the attacker can modify system files, create new user accounts, access sensitive data, and potentially compromise the entire system. The vulnerability affects multiple IRIX versions, making it particularly dangerous as organizations with legacy systems running these older versions would be exposed to this threat. The attack requires only local access to the system and knowledge of the specific removal process, making it a low-effort but high-impact vulnerability that could be exploited by both malicious insiders and external attackers who have gained initial access to the system.
Organizations should implement immediate mitigations including restricting access to system tour removal commands, verifying file integrity of system components, and ensuring that no unauthorized Trojan horse programs exist in the system directories. The recommended approach involves removing or securing the .exitops program from execution paths and implementing proper privilege separation. System administrators should also consider disabling or restricting the systour package functionality entirely if not required for operations. This vulnerability aligns with CWE-276 which addresses improper privilege management and CWE-78 which covers OS command injection, while the attack pattern corresponds to techniques described in the ATT&CK framework under privilege escalation and persistence tactics. Regular security audits should verify that no unauthorized programs exist in system directories and that proper file permissions are maintained to prevent similar privilege escalation scenarios.