Security readout for executives and security teams
Plain-English summary
An SSH server is configured to trust the legacy .rhosts file for login decisions, meaning a user can be authenticated based on a host-and-username trust list rather than a password or key. If an attacker controls a trusted host or username, they may log in without proving identity, exposing the system to unauthorized access.
Executive priority
Low executive urgency for modern environments. Treat as a hygiene item during routine hardening reviews, not an emergency. Elevate priority only if legacy Unix systems, unmanaged appliances, or acquired infrastructure are known to be in scope, since those may still carry the deprecated trust configuration.
Technical view
CVE-1999-0547 describes an SSH server permitting authentication via .rhosts, the BSD r-services trust file. This mechanism authorizes remote logins based on source hostname and username, without cryptographic proof of identity. Spoofed or compromised trusted hosts can therefore obtain shell access. The record is a configuration-class weakness with no vendor, product, CVSS, or CWE assigned in the source bundle.
Likely exposure
Exposure is limited to legacy or misconfigured SSH deployments that still enable RhostsAuthentication or RhostsRSAAuthentication and maintain populated .rhosts or hosts.equiv files. Modern OpenSSH defaults disable these options, so most current environments are not exposed. Systems most at risk are aging Unix hosts, appliances with unmodified legacy configs, and inherited environments never hardened.
Exploitation context
The public source bundle does not indicate active exploitation and the entry is not in CISA KEV. The risk is theoretical unless an attacker can spoof a trusted host, compromise a trusted user account, or influence the .rhosts contents. Historically, r-services trust has been abused in local network attacks, but no cited exploit activity accompanies this record.
Researcher notes
Record dates to 2000 with an XForce reference and no CVSS, CWE, or affected product data in the bundle. Interpret as a configuration weakness class rather than a product-specific flaw. Validate by inspecting SSH daemon configuration and file system trust artifacts. No KEV listing and no cited proof-of-concept; risk is proportional to whether host-trust authentication remains enabled.
Mitigation direction
- Disable RhostsAuthentication and RhostsRSAAuthentication in sshd_config on all SSH servers.
- Remove or empty ~/.rhosts and /etc/hosts.equiv files where they are not required.
- Enforce key-based or MFA authentication and prohibit host-trust logins via policy.
- Consult current OpenSSH or vendor SSH guidance for supported authentication modes.
Validation and detection
- Review sshd_config for RhostsAuthentication, RhostsRSAAuthentication, or IgnoreRhosts settings.
- Audit filesystems for existing .rhosts and hosts.equiv files and their contents.
- Confirm authentication logs show only key, password, or MFA-based logins, not rhosts-based.
- Run a configuration scan across the fleet to detect legacy trust-authentication settings.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-1999-0547 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://exchange.xforce.ibmcloud.com/vulnerabilities/315CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.