A Unix account has a guessable password

CVE-1999-0501 is not a software bug in a specific Unix release; it is a condition where a Unix account uses a password an attacker can guess. There is no meaningful version range or vendor patch level here: *any* Unix-like system can be "affected" if it has at least one account with a weak password and at least one authentication path that still accepts that password, such as SSH with password auth, su, console login, or a PAM-backed service.

The legacy CVSS framing overrates this for modern patch queues because it treats compromise impact in isolation and ignores the real-world friction: the attacker still needs a reachable login surface, a valid username, enough guessing attempts to succeed, and defenses that fail to throttle or block them. In practice this belongs with IAM hardening and account hygiene, not emergency patching, so the right move is to *downgrade for patch priority* while still treating confirmed weak passwords as a real security finding.

Why this verdict

• Not a patchable software defect: there is no vendor, no fixed build, and no version range to remediate through normal patch operations, which is major downward pressure in a patch-prioritization model.
• Attacker position is constrained: the attacker needs a reachable password-accepting service or local host access; if the path is internal-only or local-only, this is already post-initial-access or physically constrained.
• Exposure population is narrow and highly variable: only systems with an actual weak password are affected, and many enterprises already reduce reachability with SSH key-only auth, VPNs, bastions, MFA, or centralized identity controls.
• Modern controls should stop the noisy path: EDR, SIEM, PAM lockout, MFA, NGFW, and SSH hardening all add friction to online guessing, so the default enterprise blast radius is usually one account, not instant root compromise.

Why not higher?

There is no wormable or unauthenticated software exploit here, and no automatic host compromise. The attacker must line up multiple conditions that many mature environments have already removed: exposed password auth, a valid username, no effective throttling, and an actually weak secret.

Why not lower?

A weak password on a real Unix account is still a valid path to unauthorized access if password auth remains enabled. Once the attacker lands in a shell, follow-on impact can become serious for privileged, service, or reused accounts, so this is more than paperwork even if it is not patch-critical.

1. Disable password auth where you can — Turn off SSH password authentication in favor of keys, Kerberos, or SSO-backed flows, especially on Internet-reachable and admin-tier systems. For a LOW verdict there is no formal mitigation SLA, so treat this as backlog hygiene and roll it into your normal hardening cycle.
2. Enforce password quality in PAM — Use pam_pwquality or equivalent to require stronger local passwords and reject trivial variants, then verify the setting through configuration management. For a LOW verdict there is no SLA, so fold this into baseline hardening rather than emergency response.
3. Throttle guessing with lockout controls — Enable pam_faillock or equivalent account lockout / delay controls so online guessing turns into a detectable event instead of a low-noise brute-force path. This is especially useful on legacy hosts that still permit local password login.
4. Audit interactive local accounts — Find local human accounts, remove stale ones, and rotate credentials for accounts that are shared, dormant, or exception-based. On large fleets this is the fastest way to reduce the real affected population.
5. Watch for auth failure bursts — Alert on repeated SSH, console, and su failures by host and account, then tie them to EDR telemetry for post-login activity. This does not prevent weakness, but it makes active guessing campaigns visible.

Run this on the target Linux/Unix host as root or with sudo, because it reads PAM, SSH, and shadow-account state. Invoke it exactly like sudo bash ./check-cve-1999-0501.sh; it is a *policy and exposure screen*, not a password cracker, so centralized identity setups may return UNKNOWN.

#!/usr/bin/env bash
# check-cve-1999-0501.sh
# Purpose: screen a Linux host for conditions that make CVE-1999-0501-like weak-password risk practical.
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

if [ "${EUID:-$(id -u)}" -ne 0 ]; then
  echo "UNKNOWN"
  echo "Reason: run as root to inspect /etc/shadow, PAM, and sshd config" >&2
  exit 2
fi

have_cmd() { command -v "$1" >/dev/null 2>&1; }
file_has() { local f="$1" p="$2"; [ -f "$f" ] && grep -Eiq "$p" "$f"; }

# 1) Detect centralized auth where local file inspection is not enough.
if grep -RqsE 'pam_(sss|winbind|ldap)\.so' /etc/pam.d 2>/dev/null || grep -qsE '^\s*(passwd|group|shadow):.*(sss|ldap|winbind)' /etc/nsswitch.conf 2>/dev/null; then
  CENTRAL_AUTH=1
else
  CENTRAL_AUTH=0
fi

# 2) Check for empty local passwords on interactive accounts.
EMPTY_PASS=0
if [ -r /etc/shadow ] && [ -r /etc/passwd ]; then
  while IFS=: read -r user _ uid _ _ home shell; do
    case "$shell" in
      */nologin|*/false|"") continue ;;
    esac
    if [ "$uid" -ge 1000 ] || [ "$uid" -eq 0 ]; then
      shadow_line=$(grep -E "^${user}:" /etc/shadow 2>/dev/null || true)
      pwfield=$(printf '%s' "$shadow_line" | awk -F: '{print $2}')
      if [ -n "$shadow_line" ] && [ -z "$pwfield" ]; then
        EMPTY_PASS=1
      fi
    fi
  done < /etc/passwd
fi

# 3) Check SSH password-auth exposure.
SSH_PASSWORD_AUTH=0
SSH_ROOT_PASSWORD=0
if have_cmd sshd; then
  if sshd -T >/dev/null 2>&1; then
    sshd -T 2>/dev/null | grep -qi '^passwordauthentication yes$' && SSH_PASSWORD_AUTH=1
    sshd -T 2>/dev/null | grep -qi '^permitrootlogin yes$' && SSH_ROOT_PASSWORD=1
  elif [ -f /etc/ssh/sshd_config ]; then
    grep -Eiq '^\s*PasswordAuthentication\s+yes\b' /etc/ssh/sshd_config && SSH_PASSWORD_AUTH=1
    grep -Eiq '^\s*PermitRootLogin\s+yes\b' /etc/ssh/sshd_config && SSH_ROOT_PASSWORD=1
  fi
fi

# 4) Check PAM password quality and lockout controls.
PAM_FILES="/etc/pam.d/system-auth /etc/pam.d/password-auth /etc/pam.d/common-password /etc/pam.d/common-auth"
HAS_PWQUALITY=0
HAS_FAILLOCK=0
MINLEN_OK=0
for f in $PAM_FILES; do
  if [ -f "$f" ]; then
    grep -Eiq 'pam_(pwquality|cracklib)\.so' "$f" && HAS_PWQUALITY=1
    grep -Eiq 'pam_faillock\.so' "$f" && HAS_FAILLOCK=1
    if grep -Eiq 'pam_(pwquality|cracklib)\.so.*minlen=1[2-9]|pam_(pwquality|cracklib)\.so.*minlen=[2-9][0-9]' "$f"; then
      MINLEN_OK=1
    fi
  fi
done

# Also check pwquality.conf if present.
if [ -f /etc/security/pwquality.conf ]; then
  if grep -Eiq '^\s*minlen\s*=\s*(1[2-9]|[2-9][0-9])\b' /etc/security/pwquality.conf; then
    MINLEN_OK=1
  fi
fi

# Decision logic.
# VULNERABLE if we can prove obviously bad conditions.
if [ "$EMPTY_PASS" -eq 1 ]; then
  echo "VULNERABLE"
  echo "Reason: one or more interactive local accounts have an empty password field" >&2
  exit 1
fi

if [ "$SSH_PASSWORD_AUTH" -eq 1 ] && { [ "$HAS_PWQUALITY" -eq 0 ] || [ "$HAS_FAILLOCK" -eq 0 ] || [ "$MINLEN_OK" -eq 0 ]; }; then
  echo "VULNERABLE"
  echo "Reason: SSH password auth is enabled without strong local password-quality and lockout controls" >&2
  exit 1
fi

# PATCHED means no obvious online password path plus baseline controls present.
if [ "$CENTRAL_AUTH" -eq 0 ] && [ "$SSH_PASSWORD_AUTH" -eq 0 ] && [ "$HAS_PWQUALITY" -eq 1 ] && [ "$HAS_FAILLOCK" -eq 1 ]; then
  echo "PATCHED"
  echo "Reason: no SSH password-auth path detected and local PAM quality/lockout controls are present" >&2
  exit 0
fi

# Central auth or incomplete local visibility means we cannot prove the condition either way.
echo "UNKNOWN"
if [ "$CENTRAL_AUTH" -eq 1 ]; then
  echo "Reason: centralized identity detected; verify password policy, MFA, and lockout at the IdP/directory layer" >&2
else
  echo "Reason: no conclusive evidence of weak passwords, but host configuration alone cannot prove account passwords are unguessable" >&2
fi
exit 2

Sources

1. NVD CVE-1999-0501
2. MITRE CVE record for CVE-1999-0501
3. CISA Known Exploited Vulnerabilities Catalog
4. MITRE CWE-521 Weak Password Requirements
5. NIST SP 800-63B Digital Identity Guidelines
6. Red Hat Enterprise Linux Security Guide on pam_pwquality
7. Ubuntu manpage for pam_pwquality