Exploitation Summary
EIP tracks 1 public exploit for CVE-1999-0988. PoCs published by Brock Tellier.
AI-analyzed exploit summary This exploit leverages a buffer overflow in UnixWare 7.1's pkginstall to execute arbitrary code with dacread privileges, allowing the attacker to read /etc/shadow. It uses a shellcode to compile and execute a C program that prints the shadow file.
Description
UnixWare pkgtrans allows local users to read arbitrary files via a symlink attack.
Exploits (1)
exploitdb
WORKING POC
VERIFIED
by Brock Tellier · clocalsco
https://www.exploit-db.com/exploits/19661
This exploit leverages a buffer overflow in UnixWare 7.1's pkginstall to execute arbitrary code with dacread privileges, allowing the attacker to read /etc/shadow. It uses a shellcode to compile and execute a C program that prints the shadow file.
Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target:
UnixWare 7.1 /usr/sbin/pkginstall
No auth needed
Prerequisites:
Access to the target system · Ability to execute /usr/sbin/pkginstall
MITRE ATT&CK
devstral-2 · analyzed Feb 16, 2026
Full analysis →
References (1)
Core 1
Core References
Third Party Advisory, VDB Entry x_refsource_misc
https://exchange.xforce.ibmcloud.com/vulnerabilities/CVE-1999-0988
Scores
EPSS
0.0080
EPSS Percentile
51.6%
Details
Status
published
Products (8)
sco/unixware
2.0
sco/unixware
2.0.3
sco/unixware
2.1
sco/unixware
7.0
sco/unixware
7.0.1
sco/unixware
7.1
sco/unixware
7.1.1
sco/unixware
7.1.16
Published
Dec 04, 1999
Tracked Since
Feb 18, 2026