CVE-1999-0067: OS Command Injection
phf CGI program allows remote command execution through shell metacharacters.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
phf CGI programfrom your environment.Uninstall or delete the phf CGI program from servers running Apache HTTP Server or NCSA HTTPD if it is not required.
- Configuration
Disable the phf CGI program in the web server configuration so it cannot be executed (remove or comment out the CGI mapping for phf).
Apache HTTP Server / NCSA HTTPD (phf CGI program) phf CGI = disabled - Compensating control
Restrict access to the phf CGI (for example, block requests to phf.cgi or allow only trusted IPs) using network firewall rules or web server access controls until the vulnerable component is removed or disabled.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-0067?
CVE-1999-0067 is rated as a high-severity vulnerability due to its remote command execution capabilities.
How do I fix CVE-1999-0067?
To fix CVE-1999-0067, update to a patched version of the affected software or disable the vulnerable CGI program.
What software versions are affected by CVE-1999-0067?
CVE-1999-0067 affects Apache Http Server version 1.0.3 and NCSA HTTPD version 1.5a.
What are the risks associated with CVE-1999-0067?
The risks of CVE-1999-0067 include the potential for attackers to execute arbitrary commands on the server.
Is CVE-1999-0067 still a concern today?
While CVE-1999-0067 is an older vulnerability, its existence highlights the importance of securing outdated software that may still be in use.