CVE-1999-0450: High severity Microsoft Internet Information Server vulnerability
In IIS, an attacker could determine a real path using a request for a non-existent URL that would be interpreted by Perl (perl.exe).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
perl.exefrom your environment.Remove or uninstall perl.exe (the Perl interpreter) from the IIS server if it is not required.
- Configuration
Disable the Perl handler in IIS so requests are not interpreted by perl.exe; remove or disable any script-mapping that invokes perl.exe for incoming requests (including requests for non-existent URLs).
Microsoft Internet Information Services (IIS) - Perl handler Perl script execution (perl.exe) = disabled
Event History
Frequently Asked Questions
What is the severity of CVE-1999-0450?
CVE-1999-0450 is considered a moderate severity vulnerability.
How does CVE-1999-0450 affect IIS versions?
CVE-1999-0450 affects Microsoft Internet Information Services versions 2.0, 3.0, 4.0, and 5.0.
What types of attacks can be executed due to CVE-1999-0450?
An attacker can exploit CVE-1999-0450 to discover real paths by probing for non-existent URLs.
How do I fix CVE-1999-0450?
To fix CVE-1999-0450, update to a patched version of Microsoft Internet Information Services.
Is CVE-1999-0450 exploitable remotely?
Yes, CVE-1999-0450 can be exploited remotely by sending crafted requests to the IIS server.