CVE-1999-0043: OS Command Injection

Published Dec 4, 1996

Updated

Command execution via shell metachars in INN daemon (innd) 1.5 using "newgroup" and "rmgroup" control messages, and others.

Affected Software

14 affected components

ISC inn=1.4sec

ISC inn=1.4sec2

ISC inn=1.4unoff3

ISC inn=1.4unoff4

ISC inn=1.5

Netscape News Server=1.1

BSDI Bsd Os=2.1

Caldera OpenLinux=1.0

redhat Linux=4.0

redhat Linux=4.1

NEC Goah Intrasv=1.1

NEC Goah Networksv=1.2

NEC Goah Networksv=2.2

NEC Goah Networksv=3.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Remove
Remove INN (innd) 1.5 from your environment.
If INN (innd) 1.5 is deployed and not required, uninstall the INN daemon or stop/disable the innd service until a vendor-supplied fix is available.

Event History

Dec 4, 1996

CVE Published

05:00 AM

Data Sourced

via NVD·05:00 AM

DescriptionSeverityWeaknessAffected Software

Sep 29, 1999

CVE Published

via MITRE·08:00 AM

Data Sourced

via MITRE·08:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-1999-0043?

CVE-1999-0043 is categorized with a high severity due to the potential for command execution vulnerabilities.

How do I fix CVE-1999-0043?

To mitigate CVE-1999-0043, upgrade to a non-vulnerable version of INN or apply the necessary patches provided by the maintainers.

What systems are affected by CVE-1999-0043?

CVE-1999-0043 affects different versions of the ISC INN daemon including 1.4sec, 1.4sec2, 1.4unoff3, 1.4unoff4, and 1.5.

What are the risks associated with CVE-1999-0043?

The risks of CVE-1999-0043 include unauthorized command execution, which can lead to system compromise.

Are there any workarounds for CVE-1999-0043?

Temporary mitigations for CVE-1999-0043 involve disabling the features that utilize the vulnerable control messages until an update can be applied.