CVE-1999-1394: BSD 4.4 based operating systems, when running at security level 1, allow the root user to clear the immutab...

Security readout for executives and security teams

This issue weakens a BSD hardening feature: even at security level 1, a root user could remove protections from files marked immutable or append-only by modifying the filesystem offline. It is not described as a remote compromise. Business urgency depends on whether legacy BSD systems rely on those flags for tamper resistance. Likely limited to BSD 4.4-derived systems running at security level 1 and relying on immutable or append-only flags. The bundle does not identify specific modern products, versions, or CPEs. Treat as a targeted legacy-system risk, not an internet-wide emergency based on available evidence. Prioritize systems where BSD file flags are part of compliance, integrity monitoring, or tamper resistance. Mitigation focus: Check current vendor guidance for affected BSD-derived operating systems.; Do not rely solely on immutable or append-only flags against root-level administrators.; Restrict trusted administrator, console, rescue, and raw device access..

Prepared

Jul 1, 2026, 08:44 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.