CVE-1999-0233: Critical severity microsoft internet information services vulnerability
IIS 1.0 allows users to execute arbitrary commands using .bat or .cmd files.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable or remove handler mappings that allow execution of .bat and .cmd files in IIS; alternatively use Request Filtering to deny requests for .bat and .cmd extensions.
Microsoft Internet Information Services (IIS) handler mapping for .bat and .cmd = disabled - Compensating control
Block or filter HTTP requests for .bat and .cmd files at the WAF or network perimeter to prevent external access to those file types until server configuration is fixed.
- Operational
Scan web content and document roots for .bat and .cmd files, remove or quarantine any found, and review server logs for signs of exploitation; remediate any compromised hosts.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-0233?
CVE-1999-0233 is considered highly critical due to its ability to allow arbitrary command execution.
How do I fix CVE-1999-0233?
To fix CVE-1999-0233, upgrade to a newer version of Internet Information Services that does not have this vulnerability.
What are the potential impacts of CVE-1999-0233?
The potential impacts of CVE-1999-0233 include unauthorized access and control over the server running IIS 1.0.
Who is affected by CVE-1999-0233?
Users of Microsoft Internet Information Services version 1.0 are directly affected by CVE-1999-0233.
What type of vulnerability is CVE-1999-0233 classified as?
CVE-1999-0233 is classified as a command execution vulnerability.