CVE-1999-0380
4.6 · MEDIUMSLMail 3.1 and 3.2 allows local users to access any file in the NTFS file system when the Remote Administration Service (RAS) is enabled by setting a user's Finger File to point to the target file,…
Overview
CVE-1999-0380 is a medium-severity vulnerability affecting seattle_lab_software slmail. It was published on February 25, 1999 and has a CVSS 2.0 base score of 4.6 (MEDIUM).
This vulnerability has a CVSS 2.0 base score of 4.6, rated MEDIUM. It requires local or adjacent network access to exploit. No authentication or special privileges are required for exploitation.
Technical description
SLMail 3.1 and 3.2 allows local users to access any file in the NTFS file system when the Remote Administration Service (RAS) is enabled by setting a user's Finger File to point to the target file, then running finger on the user.
Remediation
Check the references section for vendor advisories and patches from seattle_lab_software. Update slmail to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.
Affected products
| Vendor | Product | Versions | Status |
|---|
References
How CyberStrike helps
Reason, not just scan
It reasons through your app's logic the way a human pentester would, so it finds flaws signature scanners miss.
Learn moreVerified findings
Every finding is proven exploitable before you see it, which cuts the false positives that bury real risk.
Learn moreAI-driven DAST and SAST
Probe running apps and read source from one engine, so issues are caught before and after they ship.
Learn moreOpen source
Read exactly how it tests and what it reports. CyberStrike is open source and in early access.
View the repo
Frequently asked questions
What is CVE-1999-0380?
CVE-1999-0380 is a medium-severity vulnerability affecting seattle_lab_software slmail. It was published on February 25, 1999 and has a CVSS 2.0 base score of 4.6 (MEDIUM).
How severe is CVE-1999-0380?
This vulnerability has a CVSS 2.0 base score of 4.6, rated MEDIUM. It requires local or adjacent network access to exploit. No authentication or special privileges are required for exploitation.
How do I fix or remediate CVE-1999-0380?
Check the references section for vendor advisories and patches from seattle_lab_software. Update slmail to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.
How can CyberStrike help with CVE-1999-0380?
CyberStrike is an open-source, AI-augmented pentesting engine. Rather than flag a version number, it tests whether an issue like CVE-1999-0380 is actually reachable in your own applications and APIs, then verifies each finding before reporting it. That tells you if the weakness is a real, exploitable risk in your environment or a false positive you can safely deprioritize.
Related MEDIUM CVEs from 1999
View all- 6.4CVE-1999-0520
A system-critical NETBIOS/SMB share has inappropriate access control.
View details - 6.4CVE-1999-0351
FTP PASV "Pizza Thief" denial of service and unauthorized data access. Attackers can steal data by
View details - 6.4CVE-1999-0418
Denial of service in SMTP applications such as Sendmail, when a remote attacker (e.g. spammer) uses
View details - 6.4CVE-1999-0425
talkback in Netscape 4.5 allows a local user to kill an arbitrary process of another user whose Nets
View details - 6.4CVE-1999-0763
NetBSD on a multi-homed host allows ARP packets on one network to modify ARP entries on another conn
View details - 6.4CVE-1999-0764
NetBSD allows ARP packets to overwrite static ARP entries.
View details - 6.4CVE-1999-1097
Microsoft NetMeeting 2.1 allows one client to read the contents of another client's clipboard via a
View details - 6.4CVE-1999-1485
nsd in IRIX 6.5 through 6.5.2 exports a virtual filesystem on a UDP port, which allows remote attack
View details - 6.4CVE-1999-0772
Denial of service in Compaq Management Agents and the Compaq Survey Utility via a long string sent t
View details - 6.4CVE-1999-0740
Remote attackers can cause a denial of service on Linux in.telnetd telnet daemon through a malformed
View details - 6.4CVE-2000-0024
IIS does not properly canonicalize URLs, potentially allowing remote attackers to bypass access rest
View details - 6.4CVE-1999-1167
Cross-site scripting vulnerability in Third Voice Web annotation utility allows remote users to read
View details