CVE-1999-0867: Input Validation
Denial of service in IIS 4.0 via a flood of HTTP requests with malformed headers.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Deploy network-level protections in front of affected servers (Microsoft Commercial Internet System / Microsoft Internet Information Services / Microsoft Site Server Commerce) to mitigate HTTP request floods: use a firewall, WAF, or load balancer to drop or reject requests with malformed HTTP headers and implement rate-limiting/connection throttling per client IP to reduce impact of floods.
- Operational
Enable and review HTTP request logging and alerts for unusually high request rates and malformed headers; prepare incident response steps (rate-limit or block offending IPs, failover or take affected servers offline if necessary) and monitor vendor advisories to apply any official patch or update when released.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-0867?
CVE-1999-0867 has been classified as a denial of service vulnerability in IIS 4.0.
How do I fix CVE-1999-0867?
To mitigate CVE-1999-0867, it is recommended to limit the number of simultaneous connections to the IIS server and properly configure HTTP request handling.
What software is affected by CVE-1999-0867?
CVE-1999-0867 affects Microsoft Internet Information Server 4.0, Microsoft Commercial Internet System 2.0, 2.5, and Microsoft Site Server 3.0.
What type of attack does CVE-1999-0867 describe?
CVE-1999-0867 describes a denial of service attack that floods the server with HTTP requests containing malformed headers.
Is CVE-1999-0867 still a threat today?
While CVE-1999-0867 is an older vulnerability, systems still running affected software could potentially be at risk if not properly managed.