CVE-1999-0247: Buffer Overflow
Buffer overflow in nnrpd program in INN up to version 1.6 allows remote users to execute arbitrary commands.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
ISC INN (nnrpd)from your environment.Uninstall nnrpd (or ISC INN) from systems where the NNTP service is not required.
- Configuration
Stop and disable the nnrpd service on affected hosts until a vendor fix is available.
ISC INN (nnrpd) nnrpd service = disabled/stopped - Compensating control
Restrict remote access to the nnrpd service to only trusted IPs via firewall rules or network ACLs; block access from untrusted networks until the vulnerability is remediated.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-0247?
The CVE-1999-0247 vulnerability is considered critical due to the potential for remote users to execute arbitrary commands on affected systems.
How do I fix CVE-1999-0247?
To fix CVE-1999-0247, it is recommended to upgrade to a patched version of INN that eliminates the buffer overflow vulnerability.
Which versions of INN are affected by CVE-1999-0247?
CVE-1999-0247 affects INN versions up to 1.6, including specific versions such as 1.4, 1.5, and their related security releases.
Can CVE-1999-0247 be exploited remotely?
Yes, CVE-1999-0247 can be exploited remotely by attackers, which makes it particularly dangerous to unpatched systems.
Are there any workarounds for CVE-1999-0247?
While updating to a secure version is the best course of action, temporarily restricting access to the nnrpd service can serve as a workaround for CVE-1999-0247.