CVE-1999-0270: Medium severity sgi irix vulnerability
Directory traversal vulnerability in pfdispaly.cgi program (sometimes referred to as "pfdisplay") for SGI's Performer API Search Tool (performertools) allows remote attackers to read arbitrary files.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
SGI performer_tools (pfdispaly.cgi)from your environment.Uninstall or remove the Performer API Search Tool (performer_tools) or delete the pfdispaly.cgi program if the functionality is not required.
- Configuration
Disable execution of the pfdispaly.cgi CGI (for example, remove execute permission, disable CGI handling for that file in the web server, or rename the file) to prevent remote invocation.
SGI performer_tools (pfdispaly.cgi) pfdispaly.cgi execution = disabled - Compensating control
Restrict access to the web location hosting pfdispaly.cgi using network controls or web-server access controls (firewall rules, allowlist by IP, or web server configuration) to trusted hosts only until the component is removed or fixed.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-0270?
CVE-1999-0270 is classified as a high severity vulnerability due to its ability to allow remote attackers to read arbitrary files.
How do I fix CVE-1999-0270?
To fix CVE-1999-0270, it is recommended to update to the latest version of SGI's Performer API Search Tool that addresses this directory traversal vulnerability.
What systems are affected by CVE-1999-0270?
CVE-1999-0270 affects SGI IRIX versions 6.2, 6.3, and 6.4 running the pfdisplay.cgi program.
What is directory traversal in the context of CVE-1999-0270?
In the context of CVE-1999-0270, directory traversal refers to the vulnerability that allows an attacker to navigate outside of the intended directory and access sensitive files.
Can CVE-1999-0270 lead to unauthorized access?
Yes, CVE-1999-0270 can lead to unauthorized access to sensitive files on the affected systems.