CVE-1999-0861: Race Condition
Race condition in the SSL ISAPI filter in IIS and other servers may leak information in plaintext.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable the SSL ISAPI filter in IIS and other affected servers (Microsoft Commerce Server, Microsoft Commercial Internet System, Microsoft Site Server Commerce) until an official patch or fix is available.
Microsoft Internet Information Services (SSL ISAPI filter) SSL ISAPI filter enabled = false - Compensating control
Restrict network access to the affected servers (IIS, Commerce Server, Site Server Commerce, Commercial Internet System) to trusted management IPs or internal networks via firewall rules or network segmentation to reduce exposure while a fix is not available.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-0861?
CVE-1999-0861 is classified as a medium severity vulnerability due to potential information leakage.
How do I fix CVE-1999-0861?
To mitigate CVE-1999-0861, apply the latest security patches provided by Microsoft for affected versions of their products.
Which software is affected by CVE-1999-0861?
CVE-1999-0861 affects Microsoft Internet Information Server 4.0, Microsoft Site Server 3.0, and Microsoft Commercial Internet System versions 2.0 and 2.5.
What is the impact of CVE-1999-0861?
The impact of CVE-1999-0861 is that it may allow unauthorized access to information in plaintext during SSL operations.
Is there a workaround for CVE-1999-0861?
Disabling the SSL ISAPI filter can serve as a temporary workaround for CVE-1999-0861 until a patch is applied.