CVE-1999-0191: Medium severity Microsoft Internet Information Server vulnerability
IIS newdsn.exe CGI script allows remote users to overwrite files.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Microsoft Internet Information Services newdsn.exefrom your environment.Delete or remove the newdsn.exe CGI binary/script from the webroot and any CGI directories if it is not required by your application.
- Configuration
Disable execution of the newdsn.exe CGI in IIS (for example, remove or disable the handler mapping for newdsn.exe or disable CGI execution for the application) to prevent remote users from invoking the vulnerable script.
IIS (newdsn.exe CGI) CGI execution = disabled - Compensating control
Restrict access to the newdsn.exe endpoint until it is removed or disabled — e.g., block access at the network firewall, WAF, or use IIS IP Address and Domain Restrictions to allow only trusted IPs or internal networks.
- Operational
Inspect server logs and filesystem integrity for signs of files overwritten via newdsn.exe, restore affected files from known-good backups, and continue monitoring for suspicious activity related to that CGI.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-0191?
CVE-1999-0191 is classified as a medium severity vulnerability.
How do I fix CVE-1999-0191?
To fix CVE-1999-0191, it is recommended to disable the newdsn.exe CGI script or apply security patches provided by Microsoft.
What software is affected by CVE-1999-0191?
CVE-1999-0191 affects Microsoft Internet Information Server version 3.0.
What does CVE-1999-0191 allow attackers to do?
CVE-1999-0191 allows remote users to overwrite files on the server.
Is there a workaround for CVE-1999-0191?
Yes, a workaround for CVE-1999-0191 is to restrict access to the newdsn.exe script in the server's configuration.