CVE-1999-1076
4.6 · MEDIUMIdle locking function in MacOS 9 allows local users to bypass the password protection of idled sessions by selecting the "Log Out" option and selecting a "Cancel" option in the dialog box for an ap…
Overview
CVE-1999-1076 is a medium-severity vulnerability affecting apple macos. It was published on October 26, 1999 and has a CVSS 2.0 base score of 4.6 (MEDIUM).
This vulnerability has a CVSS 2.0 base score of 4.6, rated MEDIUM. It requires local or adjacent network access to exploit. No authentication or special privileges are required for exploitation.
Technical description
Idle locking function in MacOS 9 allows local users to bypass the password protection of idled sessions by selecting the "Log Out" option and selecting a "Cancel" option in the dialog box for an application that attempts to verify that the user wants to log out, which returns the attacker into the locked session.
Remediation
Check the references section for vendor advisories and patches from apple. Update macos to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.
Affected products
| Vendor | Product | Versions | Status |
|---|
How CyberStrike helps
Reason, not just scan
It reasons through your app's logic the way a human pentester would, so it finds flaws signature scanners miss.
Learn moreVerified findings
Every finding is proven exploitable before you see it, which cuts the false positives that bury real risk.
Learn moreAI-driven DAST and SAST
Probe running apps and read source from one engine, so issues are caught before and after they ship.
Learn moreOpen source
Read exactly how it tests and what it reports. CyberStrike is open source and in early access.
View the repo
Frequently asked questions
What is CVE-1999-1076?
CVE-1999-1076 is a medium-severity vulnerability affecting apple macos. It was published on October 26, 1999 and has a CVSS 2.0 base score of 4.6 (MEDIUM).
How severe is CVE-1999-1076?
This vulnerability has a CVSS 2.0 base score of 4.6, rated MEDIUM. It requires local or adjacent network access to exploit. No authentication or special privileges are required for exploitation.
How do I fix or remediate CVE-1999-1076?
Check the references section for vendor advisories and patches from apple. Update macos to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.
How can CyberStrike help with CVE-1999-1076?
CyberStrike is an open-source, AI-augmented pentesting engine. Rather than flag a version number, it tests whether an issue like CVE-1999-1076 is actually reachable in your own applications and APIs, then verifies each finding before reporting it. That tells you if the weakness is a real, exploitable risk in your environment or a false positive you can safely deprioritize.
Related MEDIUM CVEs from 1999
View all- 6.4CVE-1999-0520
A system-critical NETBIOS/SMB share has inappropriate access control.
View details - 6.4CVE-1999-0351
FTP PASV "Pizza Thief" denial of service and unauthorized data access. Attackers can steal data by
View details - 6.4CVE-1999-0418
Denial of service in SMTP applications such as Sendmail, when a remote attacker (e.g. spammer) uses
View details - 6.4CVE-1999-0425
talkback in Netscape 4.5 allows a local user to kill an arbitrary process of another user whose Nets
View details - 6.4CVE-1999-0763
NetBSD on a multi-homed host allows ARP packets on one network to modify ARP entries on another conn
View details - 6.4CVE-1999-0764
NetBSD allows ARP packets to overwrite static ARP entries.
View details - 6.4CVE-1999-1097
Microsoft NetMeeting 2.1 allows one client to read the contents of another client's clipboard via a
View details - 6.4CVE-1999-1485
nsd in IRIX 6.5 through 6.5.2 exports a virtual filesystem on a UDP port, which allows remote attack
View details - 6.4CVE-1999-0772
Denial of service in Compaq Management Agents and the Compaq Survey Utility via a long string sent t
View details - 6.4CVE-1999-0740
Remote attackers can cause a denial of service on Linux in.telnetd telnet daemon through a malformed
View details - 6.4CVE-2000-0024
IIS does not properly canonicalize URLs, potentially allowing remote attackers to bypass access rest
View details - 6.4CVE-1999-1167
Cross-site scripting vulnerability in Third Voice Web annotation utility allows remote users to read
View details