CVE-1999-0039: Command Injection
webdist CGI program (webdist.cgi) in SGI IRIX allows remote attackers to execute arbitrary commands via shell metacharacters in the distloc parameter.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
SGI IRIX webdist CGI (webdist.cgi)from your environment.Remove or uninstall the webdist CGI program (webdist.cgi) from the web server or filesystem, or delete the webdist.cgi file if the functionality is not required.
- Configuration
Disable execution of webdist.cgi by removing execute/CGI handlers for that file or disabling CGI execution for the directory in the web server configuration.
web server (CGI execution) execution of webdist.cgi / CGI in hosting directory = disabled - Compensating control
Restrict access to the webdist.cgi URL to trusted IPs or networks using firewall rules or web server access controls (allowlist) to prevent remote access until the vulnerability is fully remediated.
- Operational
Inspect logs and system for signs of unauthorized command execution; if compromise is suspected, isolate affected hosts, perform incident response, and rotate or revoke any potentially exposed credentials or keys before restoring services.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-0039?
CVE-1999-0039 is classified as a critical vulnerability due to its potential for remote command execution.
How do I fix CVE-1999-0039?
To mitigate CVE-1999-0039, you should update to a patched version of SGI IRIX where this vulnerability has been addressed.
Which software versions are affected by CVE-1999-0039?
CVE-1999-0039 affects SGI IRIX versions 5.0, 5.1, 5.2, 5.3, 6.1, 6.2, and 6.3.
What type of attack can be performed using CVE-1999-0039?
CVE-1999-0039 allows remote attackers to execute arbitrary commands on the vulnerable system.
Is CVE-1999-0039 still relevant today?
While CVE-1999-0039 is an older vulnerability, its presence in legacy systems may still pose security risks.