Security readout for executives and security teams
Plain-English summary
A very old flaw in SCO UnixWare's dos7utils package let anyone with a local login on the server become the all-powerful root user. The utility trusted an environment variable (STATICMERGE) to locate a script it would run, so a logged-in user could redirect it to a script of their choosing. Impact is limited to legacy UnixWare systems that are extremely unlikely to be in modern production use.
Executive priority
Very low priority for any modern enterprise. Only relevant if the business still operates SCO UnixWare servers with local user accounts; in that case, treat it as one more reason to accelerate migration off unsupported UNIX platforms rather than as a standalone incident.
Technical view
CVE-1999-0942 describes a local privilege escalation in UnixWare's dos7utils. The tool honored the user-controlled STATICMERGE environment variable to find and execute a script. Because dos7utils runs with elevated privileges, an unprivileged local user could point STATICMERGE at an attacker-controlled script and have it executed as root. The public record contains no CVSS score, no CWE mapping, and no vendor patch reference in the bundled sources.
Likely exposure
Exposure is confined to legacy SCO UnixWare hosts with the dos7utils package installed and shell access available to untrusted local users. UnixWare is end-of-life for most enterprises, so real-world exposure in 2026 is negligible outside of niche industrial, retail, or archival environments still running unsupported SCO systems.
Exploitation context
No entry in CISA KEV and no cited evidence of active exploitation. The flaw requires prior local access, which limits scale. The bundled sources do not reference a public exploit; the X-Force reference is the only third-party pointer, and it is a summary, not a weaponized artifact.
Researcher notes
Record is sparse: no CVSS, no CWE, no vendor advisory link, and affected product fields are 'n/a'. The behavior matches CWE-426 (Untrusted Search Path) or CWE-427-style patterns via an environment variable used to locate an executed script. Treat the X-Force reference as the primary corroborating public source. Confidence in the mechanism is reasonable; confidence in specific affected versions is low without vendor confirmation.
Mitigation direction
- Inventory environment for any surviving UnixWare hosts and the dos7utils package.
- Restrict local shell access on legacy UnixWare systems to trusted administrators only.
- Consult SCO/Xinuos vendor guidance for any legacy patch or configuration workaround.
- Prioritize migrating remaining UnixWare workloads to a supported operating system.
- Remove or disable dos7utils where DOS interoperability is no longer required.
Validation and detection
- Enumerate installed packages on UnixWare hosts to confirm presence of dos7utils.
- Check the setuid/setgid bits and ownership of the dos7utils binary.
- Review whether unprivileged local accounts exist on any affected host.
- Audit environment variable handling and script paths invoked by dos7utils.
- Correlate findings with vendor advisories from SCO/Xinuos before declaring remediated.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-1999-0942 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://exchange.xforce.ibmcloud.com/vulnerabilities/CVE-1999-0942CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.