CVE-1999-0239: High severity Netscape Fasttrack Server vulnerability
Netscape FastTrack Web server lists files when a lowercase "get" command is used instead of an uppercase GET.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Netscape FastTrack Serverfrom your environment.Uninstall or replace the Netscape FastTrack Server if it cannot be patched; migrate content to a supported web server or a vendor-fixed version when available.
- Configuration
Disable directory listing / automatic index generation so the server will not return file lists when a lowercase 'get' command is used.
Netscape FastTrack Server directory_listing = disabled - Compensating control
Restrict access to the affected web server to trusted IP addresses using a firewall, network ACLs, or a reverse proxy/WAF until an official vendor fix is applied.
- Operational
Monitor web server access logs for requests using a lowercase 'get' and review any returned directory listings for sensitive data exposure; perform incident response if disclosure is detected.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-0239?
The severity of CVE-1999-0239 is typically considered low, as it primarily involves improper case handling in HTTP requests.
How do I fix CVE-1999-0239?
To fix CVE-1999-0239, ensure that the Netscape FastTrack Server is updated to a version that handles case sensitivity properly.
What systems are affected by CVE-1999-0239?
CVE-1999-0239 affects the Netscape FastTrack Server version 3.01.
What type of vulnerability is CVE-1999-0239?
CVE-1999-0239 is classified as a server misconfiguration vulnerability due to improper handling of HTTP command case.
Can CVE-1999-0239 lead to data exposure?
Yes, CVE-1999-0239 can potentially lead to data exposure by allowing unauthorized file listings through the web server.