CVE-1999-0744: Buffer Overflow
Buffer overflow in Netscape Enterprise Server and FastTrask Server allows remote attackers to gain privileges via a long HTTP GET request.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Netscape Enterprise Server / Netscape FastTrack Serverfrom your environment.If these products are not required, uninstall/replace them to eliminate the vulnerable software from the environment.
- Configuration
Configure the server (or a front-end proxy) to validate and reject HTTP requests whose request line (URL/GET) exceeds a reasonable length to prevent buffer-overflow exploitation via long GET requests.
Netscape Enterprise Server / Netscape FastTrack Server maximum HTTP request line length = reject overly long GET request lines - Compensating control
Deploy a Web Application Firewall (WAF) or perimeter filtering (reverse proxy/load balancer) to detect and block HTTP requests with excessively long request lines or unusually long GET requests before they reach the Netscape servers.
- Compensating control
Restrict access to the affected servers to only trusted IP ranges at the network perimeter (firewall/ACL) to reduce exposure to remote exploitation.
- Operational
Monitor server and access logs for attempts using unusually long GET requests; investigate for signs of compromise. If compromise is suspected, isolate affected hosts, rebuild or reimage them, and rotate any potentially exposed credentials.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-0744?
CVE-1999-0744 is considered high severity due to the potential for remote attackers to gain privileges.
How do I fix CVE-1999-0744?
To fix CVE-1999-0744, update to the latest version of Netscape Enterprise Server or FastTrack Server that includes the necessary patches.
What software is affected by CVE-1999-0744?
CVE-1999-0744 affects Netscape Enterprise Server and Netscape FastTrack Server.
What type of vulnerability is CVE-1999-0744?
CVE-1999-0744 is a buffer overflow vulnerability caused by processing long HTTP GET requests.
Can CVE-1999-0744 be exploited remotely?
Yes, CVE-1999-0744 can be exploited remotely by attackers sending specially crafted HTTP requests.