CVE-1999-1138: SCO UNIX System V/386 Release 3.2, and other SCO products, installs the home directories (1) /tmp for the d...

Security readout for executives and security teams

Old SCO UNIX systems shipped with two built-in user accounts whose home directories were placed in shared, world-writable temporary folders. Because anyone on the system could write to those folders, a low-privileged user could plant files that hijacked those accounts and gain access to them. The issue is decades old and only matters if a legacy SCO UNIX system is still in production. Exposure is limited to organizations still running SCO UNIX System V/386 Release 3.2 or contemporaneous SCO products from the early 1990s. Modern environments are not affected. Any residual risk is confined to unpatched legacy hosts where the dos and asg accounts remain enabled and local user access exists. Very low priority for modern environments. Only material if the business still operates SCO UNIX System V/386 or similar legacy SCO hosts; in that case, treat it as part of a broader legacy decommissioning plan rather than an emergency patch. Mitigation focus: Review vendor guidance from SCO successors (Xinuos) for legacy System V/386 hardening.; Disable or lock the dos and asg accounts if not required.; Reassign home directories away from /tmp and /usr/tmp for any pre-set accounts..

Prepared

Jul 11, 2026, 12:52 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.