CVE-1999-0146: High severity NCSA campas vulnerability
The campas CGI program provided with some NCSA web servers allows an attacker to execute arbitrary commands via encoded carriage return characters in the query string, as demonstrated by reading the password file.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
NCSA CAMPASfrom your environment.Uninstall or remove the campas CGI program from affected NCSA HTTPd installations to eliminate the vulnerable CGI component.
- Configuration
Disable the campas CGI in the web server configuration (prevent execution or remove the CGI mapping) so query strings cannot be handled by campas.
NCSA HTTPd campas CGI enabled = false - Compensating control
If immediate removal or disabling is not possible, restrict access to the campas CGI to trusted hosts or internal networks using firewall rules, ACLs, or web-server access controls.
- Operational
Because the vulnerability can allow reading the password file, assume possible credential exposure: rotate affected system and user credentials and audit logs for signs of exploitation.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-0146?
CVE-1999-0146 has a high severity rating due to the potential for remote command execution.
How do I fix CVE-1999-0146?
To fix CVE-1999-0146, it is recommended to remove or restrict access to the campas CGI program on affected NCSA web servers.
What systems are affected by CVE-1999-0146?
CVE-1999-0146 affects certain versions of the NCSA CAMPAS CGI program and NCSA HTTPd web server.
What type of attack is associated with CVE-1999-0146?
CVE-1999-0146 is associated with remote command execution attacks through the manipulation of HTTP query strings.
Is CVE-1999-0146 still a relevant threat today?
While CVE-1999-0146 is an older vulnerability, any systems still using affected software may remain at risk.