CVE-1999-1499

ISC BIND <8.1 - Local Privilege Escalation

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-1999-1499. PoCs published by Joe H.

AI-analyzed exploit summary This exploit leverages a symbolic link vulnerability in BIND (named daemon) to overwrite or append to arbitrary files when SIGINT or SIGIOT signals are sent. The PoC demonstrates creating symbolic links to /etc/passwd to achieve privilege escalation or file corruption.

Description

named in ISC BIND 4.9 and 8.1 allows local users to destroy files via a symlink attack on (1) named_dump.db when root kills the process with a SIGINT, or (2) named.stats when SIGIOT is used.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Joe H · textlocallinux

https://www.exploit-db.com/exploits/19072

View Code ZIP pw:eip

This exploit leverages a symbolic link vulnerability in BIND (named daemon) to overwrite or append to arbitrary files when SIGINT or SIGIOT signals are sent. The PoC demonstrates creating symbolic links to /etc/passwd to achieve privilege escalation or file corruption.

Classification

Working Poc 90%

Attack Type

Lpe

Complexity

Trivial

Reliability

Reliable

Target: BIND (named daemon) versions prior to 8.1.x

No auth needed

Prerequisites: Access to create symbolic links in /var/tmp · Ability to send signals to the named process (typically root)

MITRE ATT&CK

T1068 - Exploitation for Privilege Escalation T1222 - File and Directory Permissions Modification

mistral-large-3 · analyzed Feb 16, 2026 Full analysis →

References (2)

Core 2

Core References

Exploit, Vendor Advisory mailing-list x_refsource_bugtraq

http://www.securityfocus.com/archive/1/8966

Exploit, Patch, Vendor Advisory vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/80

Scores

EPSS 0.0069

EPSS Percentile 48.5%

Details

Status published

Products (2)

isc/bind 4.9

isc/bind 8.1

Published Apr 10, 1998

Tracked Since Feb 18, 2026