CVE-1999-0046: rlogin buffer overflow via TERM environment variable

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityThe flaw is a remotely reachable, unauthenticated buffer overflow with a 10.0 CVSS 2.0 score and high EPSS, though it is not in KEV and the record lacks version and patch detail.

What it is

The rlogin program contains a classic buffer overflow (CWE-120) triggered through the TERM environment variable. Because rlogin is a network login service, a remote attacker can supply an oversized TERM value and corrupt memory. The record is old and thin: it names no specific affected versions and gives no patch reference.

Impact

Successful exploitation can crash the service or allow arbitrary code execution in the context of the rlogin process, which historically ran with elevated privileges. That gives an attacker a path to remote compromise of the host.

Attack surface

Reached over the network against the rlogin service, per the AV:N vector; the CVSS 2.0 vector shows no authentication (Au:N) and no user interaction. The attacker only needs to control the TERM value passed to the service.

Exploitation

Not listed in CISA KEV and no public exploit references are tagged in the record, but EPSS is high at roughly 0.52 (98.9th percentile), indicating elevated predicted exploitation activity.

What to do

• Apply the vendor patch or upgrade for rlogin on the affected platform; this is a decades-old flaw, so confirm current support status with each vendor.
• Disable rlogin/rsh services and replace them with SSH where still enabled.
• Block TCP port 513 at network boundaries and restrict rlogin to trusted hosts if it cannot be removed.
• Sanitize or length-limit the TERM environment variable before it reaches rlogin.
• Monitor vendor advisories for the listed platforms (BSD variants, Solaris/SunOS, AIX, HP-UX, Ultrix, NEXTSTEP, Debian) since the record does not specify versions.

Detection

• Search host and network logs for rlogin connections (TCP 513) from untrusted sources.
• Alert on rlogin processes crashing or terminating abnormally, which may indicate overflow attempts.
• Inspect process environments and login records for unusually long or malformed TERM values.
• Audit hosts still running rlogin and confirm whether the service is exposed.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.