CVE-1999-0149: High severity SGI IRIX vulnerability
The wrap CGI program in IRIX allows remote attackers to view arbitrary directory listings via a .. (dot dot) attack.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
SGI IRIX wrap CGIfrom your environment.Uninstall or remove the 'wrap' CGI program from affected IRIX systems if it is not required.
- Configuration
Disable execution of the wrap CGI (for example, remove it from the web server's cgi-bin, revoke execute permissions, or otherwise prevent the web server from invoking it).
SGI IRIX wrap CGI cgi_execution = disabled - Compensating control
Restrict access to the web server/CGI endpoints (including the wrap CGI) to trusted IPs via firewall rules, ACLs, or a web application firewall to prevent remote exploitation.
- Operational
Search web server logs for requests to the wrap CGI (and for ../ patterns) and investigate any suspected access to determine if the vulnerability was exploited; remediate any discovered exposure.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-0149?
CVE-1999-0149 has a medium severity level due to its potential to expose sensitive directory listings.
How do I fix CVE-1999-0149?
To fix CVE-1999-0149, you should upgrade to a patched version of IRIX or implement strict access controls on the CGI program.
What systems are affected by CVE-1999-0149?
CVE-1999-0149 specifically affects the IRIX 6.2 operating system.
Can CVE-1999-0149 be exploited remotely?
Yes, CVE-1999-0149 allows remote attackers to exploit the vulnerability and access unauthorized directory listings.
What type of attack is CVE-1999-0149 associated with?
CVE-1999-0149 is associated with a directory traversal attack using a .. (dot dot) sequence.