CVE-1999-0045: High severity Netscape Communications Server vulnerability

Published Dec 10, 1996

Updated

List of arbitrary files on Web host via nph-test-cgi script.

Affected Software

11 affected components

Netscape Communications Server=1.1

Apache HTTP Server=1.0.5

Apache HTTP Server=0.8.11

Netscape Enterprise server=2.0a

Apache HTTP Server=1.0.2

Apache HTTP Server=1.1

Apache HTTP Server=1.0

Apache HTTP Server=1.0.3

Apache HTTP Server=0.8.14

Netscape Communications Server=1.12

Netscape Commerce Server=1.12

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Remove
Remove nph-test-cgi from your environment.
Remove the nph-test-cgi script from the web server (cgi-bin) or otherwise uninstall the script from hosts to prevent listing arbitrary files.
Configuration
Disable execution of the nph-test-cgi script by removing it from configured CGI handlers, disabling CGI execution for that path, or changing file permissions to prevent execution.
Web server (CGI handlers / cgi-bin) nph-test-cgi execution = disabled
Compensating control
Restrict access to the nph-test-cgi script using network controls or web server access controls (e.g., firewall rules, IP allowlist, Require/deny or .htaccess) so only trusted management IPs can reach it or block access entirely.
Operational
Search servers for any instances of nph-test-cgi, review web server logs for accesses to the script to determine if arbitrary file listing was attempted or used, and remove any remaining copies.

Event History

Dec 10, 1996

CVE Published

05:00 AM

Data Sourced

via NVD·05:00 AM

DescriptionSeverityAffected Software

Sep 29, 1999

CVE Published

via MITRE·08:00 AM

Data Sourced

via MITRE·08:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-1999-0045?

CVE-1999-0045 is considered a high severity vulnerability due to its potential to expose sensitive files on the web host.

How do I fix CVE-1999-0045?

To fix CVE-1999-0045, update your affected web server software to a patched version that addresses this vulnerability.

What systems are affected by CVE-1999-0045?

CVE-1999-0045 affects specific versions of Netscape Communications Server, Netscape Enterprise Server, Netscape Commerce Server, and various versions of Apache HTTP Server.

What type of vulnerability is CVE-1999-0045?

CVE-1999-0045 is a file disclosure vulnerability that allows attackers to list arbitrary files on the web host.

Is there any workaround for CVE-1999-0045?

There are limited workarounds for CVE-1999-0045, but the safest approach is to upgrade to a secure version of the affected software.