CVE-1999-0807: High severity Netscape Directory Server vulnerability
The Netscape Directory Server installation procedure leaves sensitive information in a file that is accessible to local users.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Netscape Directory Serverfrom your environment.Identify any leftover installation files that contain sensitive information and securely remove or sanitize them if they are not required for operation (securely delete or overwrite files to prevent recovery).
- Configuration
Modify filesystem permissions or ACLs on any files created by the Netscape Directory Server installer that contain sensitive information so that non-privileged local users cannot read them (for example, change file owner to a privileged account and set permissions to limit access, or apply appropriate OS-level ACLs).
Netscape Directory Server installation-created file permissions = restrict read access to administrative/root accounts only - Operational
Rotate or replace any credentials, keys, or other secrets that may have been written to the installer-created file and possibly exposed to local users before fixing file access controls.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-0807?
The severity of CVE-1999-0807 is classified as medium due to the exposure of sensitive information.
How do I fix CVE-1999-0807?
To fix CVE-1999-0807, ensure that sensitive files created during the installation of Netscape Directory Server are secured and not accessible to local users.
Who is affected by CVE-1999-0807?
Anyone using Netscape Directory Server may be affected by CVE-1999-0807 if the installation process leaves sensitive files accessible.
What type of information is exposed in CVE-1999-0807?
CVE-1999-0807 exposes sensitive configuration data that could be exploited by local users.
Is CVE-1999-0807 still relevant today?
CVE-1999-0807 is considered historically relevant, particularly for legacy systems still running Netscape Directory Server.