CVE-1999-1565 in man2html
Summary
by MITRE
Man2html 2.1 and earlier allows local users to overwrite arbitrary files via a symlink attack on a temporary file.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 04/19/2026
The vulnerability identified as CVE-1999-1565 affects the man2html utility version 2.1 and earlier, representing a classic file system security flaw that exploits symbolic link manipulation. This issue specifically targets the temporary file handling mechanism within the man2html conversion process, where the utility creates temporary files during its operation to store intermediate conversion results. The vulnerability arises from the predictable naming scheme of these temporary files and the lack of proper security checks during their creation, allowing local attackers with access to the system to exploit this weakness through a carefully crafted symlink attack.
The technical exploitation of this vulnerability occurs when the man2html utility creates temporary files in a world-writable directory such as /tmp without proper security measures to verify that these files are created with appropriate permissions and ownership. An attacker can create symbolic links with the same names that the utility expects to create, effectively redirecting the utility's write operations to arbitrary locations on the file system. This allows the attacker to overwrite files with malicious content, potentially including system binaries, configuration files, or sensitive data. The flaw is classified as a directory traversal vulnerability and falls under the CWE-377 weakness category, which specifically addresses the creation of temporary files with insecure permissions and predictable names.
The operational impact of this vulnerability extends beyond simple file overwrites to potentially enable more sophisticated attacks including privilege escalation and system compromise. When the man2html utility is executed with elevated privileges, such as through setuid binaries or during system administration tasks, the attacker's ability to overwrite critical system files increases significantly. This vulnerability particularly affects Unix-like systems where the utility may be invoked with root privileges or where temporary files are created in insecure locations. The attack vector demonstrates the fundamental principle of privilege escalation through insecure temporary file handling, which is categorized under the ATT&CK technique T1068 - Exploitation for Privilege Escalation.
Mitigation strategies for this vulnerability involve multiple layers of defense to prevent the exploitation of insecure temporary file creation. System administrators should immediately upgrade to man2html versions 2.2 and later, where the developers have implemented proper temporary file handling mechanisms including the use of mkstemp() functions instead of predictable naming schemes. Additionally, systems should be configured to ensure that temporary directories are not world-writable, and that the utility is not executed with elevated privileges when possible. The implementation of proper file permission controls and the use of secure temporary file creation functions such as those provided by POSIX standards helps prevent the symlink attack vector. Organizations should also conduct regular security audits of their systems to identify and remediate similar vulnerabilities in other utilities that may be susceptible to the same class of attack, as this represents a common pattern in Unix system security that has been documented extensively in various security frameworks and vulnerability databases.