Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
2.1

Solaris ps command lets local users see other processes' environment

CVE-1999-1587 · published 26 years ago
Summary

On Solaris 8, 9, and some earlier releases, the standard ps utility can be run with the -e option to display environment variables from any process on the system. This allows any user with local access to see potentially sensitive data such as passwords or keys that other programs are using. Apply the Solaris security update that removes this behavior or replace the utility with a version that restricts access to only the user's own processes.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
sun solaris 9.0
cpe:2.3:o:sun:solaris:9.0:*:sparc:*:*:*:*:*
sun sunos 5.8
cpe:2.3:o:sun:sunos:5.8:*:*:*:*:*:*:*
Original advisory text
/usr/ucb/ps in Sun Microsystems Solaris 8 and 9, and certain earlier releases, allows local users to view the environment variables and values of arbitrary processes via the -e option.
/usr/ucb/ps in Sun Microsystems Solaris 8 and 9, and certain earlier releases, allows local users to view the environment variables and values of arbitrary processes via the -e option.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
2.1 Low
Exploitation
<1% chance of attack within 30 days
Timeline
Published31 Dec 1999
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-1999-1587 · NVD
Track software like this
Free during beta