PT-1999-1604 · Website Pro+1 · Website Pro+1

Published 1999-02-16 · Updated 2008-09-10 · CVE-1999-1180

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions O'Reilly WebSite version 1.1e Website Pro version 2.0

Description The issue allows remote attackers to execute arbitrary commands. This can be achieved by using shell metacharacters in an argument to either the args.cmd or args.bat functions.

Recommendations For O'Reilly WebSite version 1.1e, consider disabling the args.cmd and args.bat functions until a patch is available. For Website Pro version 2.0, restrict access to the args.cmd and args.bat functions to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-1999-1180

Affected Products

O'Reilly Website

Website Pro

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-1999-1180 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-1180 · Note
• http://oliver.efri.hr/~crv/security/bugs/NT/buffer.html · Note
• http://tryc.on.ca/archives/bugtraq/1999_1/0612.html · Note