CVE-1999-0034

Perl 4.x and 5.x - Buffer Overflow in suidperl

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 4 public exploits for CVE-1999-0034. PoCs published by vade79, Willy Tarreau, Pavel Kankovsky.

AI-analyzed exploit summary This exploit targets a buffer overflow vulnerability in BSDi's suidperl (CVE-1999-0034) to achieve privilege escalation (euid=0). It uses a stack-based overflow with a hardcoded shellcode to spawn a shell.

Description

Buffer overflow in suidperl (sperl), Perl 4.x and 5.x.

Exploits (4)

exploitdb WORKING POC VERIFIED
by vade79 · clocalbsd
https://www.exploit-db.com/exploits/200

This exploit targets a buffer overflow vulnerability in BSDi's suidperl (CVE-1999-0034) to achieve privilege escalation (euid=0). It uses a stack-based overflow with a hardcoded shellcode to spawn a shell.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: BSDi suidperl (BSDi/3.0)
No auth needed
Prerequisites: Access to a vulnerable BSDi system with suidperl installed · Ability to execute the compiled exploit binary
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WRITEUP VERIFIED
by Willy Tarreau · textlocalmultiple
https://www.exploit-db.com/exploits/19547

The entry describes a buffer overflow vulnerability in 'suidperl' or 'sperl' when installed setuid root, potentially leading to local root compromise. It references an external source for the exploit details but does not contain actual exploit code.

Classification
Writeup 80%
Attack Type
Lpe
Complexity
Moderate
Reliability
Theoretical
Target: Perl suidperl/sperl (versions affected in 1999)
No auth needed
Prerequisites: suidperl or sperl installed setuid root
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WORKING POC VERIFIED
by Pavel Kankovsky · perllocalmultiple
https://www.exploit-db.com/exploits/19546

This exploit targets a buffer overflow vulnerability in suidperl (sperl) to achieve local privilege escalation. It uses a brute-force approach to find the correct memory address for shellcode execution.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Moderate
Reliability
Racy
Target: suidperl (sperl) 5.003
No auth needed
Prerequisites: suidperl installed setuid root · local access to the target system
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WORKING POC VERIFIED
by Jon Lewis · perllocallinux
https://www.exploit-db.com/exploits/320

This exploit leverages a vulnerability in suidperl to execute a shell with elevated privileges. It sets the PATH environment variable and drops privileges before executing /bin/bash.

Classification
Working Poc 90%
Attack Type
Lpe
Complexity
Trivial
Reliability
Reliable
Target: suidperl (Perl with setuid)
No auth needed
Prerequisites: suidperl installed with setuid bit set
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (1)

Core 1
Core References
Third Party Advisory, VDB Entry x_refsource_misc
https://exchange.xforce.ibmcloud.com/vulnerabilities/CVE-1999-0034

Scores

EPSS 0.0118
EPSS Percentile 63.4%

Details

Status published
Products (8)
bsdi/bsd_os 2.1
bsdi/bsd_os 3.0
larry_wall/perl 5.3
redhat/linux 4.0
redhat/linux 4.1
redhat/linux 4.2
sgi/freeware 1.0
sgi/freeware 2.0
Published May 29, 1997
Tracked Since Feb 18, 2026