PT-1999-1551 · Apache · Apache

Publicado 1999-09-13 · Atualizado 2008-09-05 · CVE-1999-1053

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions guestbook.pl (affected versions not specified) Apache versions 1.3.9 and possibly other versions

Description The issue allows remote attackers to execute arbitrary commands due to the incomplete removal of user-inserted SSI commands by guestbook.pl. This is possible because Apache allows other closing sequences besides "-->".

Recommendations For Apache version 1.3.9, consider updating to a newer version to mitigate the risk of exploitation. As a temporary workaround, consider restricting access to guestbook.pl until a patch is available. Avoid using SSI commands in guestbook.pl until the issue is resolved.

Exploit

Correção

Identificadores relacionados

CVE-1999-1053

Produtos afetados

Apache

Referências · 9

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/guestbook_ssi_exec.rb · Exploit
• 🔥 https://exploit-db.com/exploits/9907 · Exploit
• 🔥 http://securityfocus.com/archive/82/27296 · Exploit
• 🔥 https://exploit-db.com/exploits/16914 · Exploit
• 🔥 http://securityfocus.com/bid/776 · Exploit
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-1053 · Nota
• http://securityfocus.com/archive/1/33674 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-1999-1053 · Nota de Segurança
• http://securityfocus.com/archive/82/27560 · Aviso do Fabricante