CVE-1999-1545 in JOE
Summary
by MITRE
Joe's Own Editor (joe) 2.8 sets the world-readable permission on its crash-save file, DEADJOE, which could allow local users to read files that were being edited by other users.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 04/19/2026
The vulnerability identified as CVE-1999-1545 affects Joe s Own Editor version 2.8, a widely used text editor in Unix-like environments. This issue represents a classic privilege escalation and information disclosure flaw that exploits improper file permission handling within the editor's crash recovery mechanism. The vulnerability specifically targets the crash-save file named DEADJOE that the editor creates when it encounters unexpected termination or crashes during file editing sessions.
The technical flaw stems from the editor's failure to properly secure its temporary crash recovery files. When joe encounters a crash or unexpected termination while editing a file, it automatically creates a DEADJOE file in the working directory to preserve the user's editing progress. However, the editor creates this file with world-readable permissions, meaning any local user on the system can access and read the contents of these crash files. This design flaw directly violates the principle of least privilege and creates a significant security risk in multi-user environments.
The operational impact of this vulnerability extends beyond simple information disclosure. Local users can exploit this weakness to gain access to sensitive data that was being edited by other users, potentially exposing confidential documents, source code, passwords, or personal information. The vulnerability is particularly dangerous in shared computing environments such as development servers, academic computing labs, or multi-user systems where multiple individuals share the same system resources. An attacker with local access can systematically search for DEADJOE files in various directories and read the contents of files that were being actively edited by other users.
This vulnerability aligns with CWE-732: Incorrect Permission Assignment for Critical Resource, which specifically addresses situations where critical system resources are assigned incorrect permissions that allow unauthorized access. The flaw also corresponds to ATT&CK technique T1005: Data from Local System, as it enables adversaries to extract sensitive data from local system files. The issue demonstrates poor secure coding practices and inadequate consideration of file system security implications during the development of system utilities. The vulnerability affects systems running joe version 2.8 and potentially earlier versions, making it a widespread concern in Unix-based environments where this editor was commonly deployed.
The recommended mitigations include updating to a patched version of joe that properly secures crash recovery files with appropriate permissions, typically restricting access to the file owner only. System administrators should also implement proper file permission monitoring and regularly audit system directories for the presence of crash files. Additionally, users should be educated about the risks of running unpatched software and the importance of maintaining current security updates. Organizations may need to implement additional monitoring controls to detect and prevent unauthorized access to temporary files in shared computing environments. The vulnerability highlights the critical importance of proper file permission management in system utilities and the potential consequences of neglecting security considerations in commonly used applications.