PT-1999-1551 · Apache · Apache

Published 1999-09-13 · Updated 2008-09-05 · CVE-1999-1053

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions guestbook.pl (affected versions not specified) Apache versions 1.3.9 and possibly other versions

Description The issue allows remote attackers to execute arbitrary commands due to the incomplete removal of user-inserted SSI commands by guestbook.pl. This is possible because Apache allows other closing sequences besides "-->".

Recommendations For Apache version 1.3.9, consider updating to a newer version to mitigate the risk of exploitation. As a temporary workaround, consider restricting access to guestbook.pl until a patch is available. Avoid using SSI commands in guestbook.pl until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-1999-1053

Affected Products

Apache

References · 9

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/guestbook_ssi_exec.rb · Exploit
• 🔥 https://exploit-db.com/exploits/9907 · Exploit
• 🔥 http://securityfocus.com/archive/82/27296 · Exploit
• 🔥 https://exploit-db.com/exploits/16914 · Exploit
• 🔥 http://securityfocus.com/bid/776 · Exploit
• http://securityfocus.com/archive/1/33674 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-1999-1053 · Security Note
• http://securityfocus.com/archive/82/27560 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-1053 · Note