CVE-1999-1137: The permissions for the /dev/audio device on Solaris 2.2 and earlier, and SunOS 4.1.x, allow any local user...

Security readout for executives and security teams

On very old Sun systems (Solaris 2.2 and earlier, SunOS 4.1.x), the microphone device was readable by any user logged into the machine. That meant a local user could quietly listen to conversations happening near a workstation with a mic. Modern enterprises rarely run these systems, so this is largely a historical eavesdropping/privacy issue rather than a current business risk. Extremely narrow. Only affects Solaris 2.2 and earlier and SunOS 4.1.x workstations equipped with a microphone. These platforms are end-of-life and effectively absent from modern enterprise environments. Exposure requires an interactive local user account and physical proximity of a microphone to something worth overhearing. Very low priority for modern estates. Treat as a legacy hygiene item: only relevant if the organization still operates end-of-life Sun workstations in areas where conversations could be overheard. No emergency action is warranted absent such systems. Mitigation focus: Retire or isolate any surviving Solaris 2.2 / SunOS 4.1.x systems from sensitive areas.; Apply the vendor guidance in Sun security bulletin 00122 to restrict /dev/audio permissions.; Where legacy systems must remain, physically disconnect or disable attached microphones..

Prepared

Jul 11, 2026, 12:52 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.