CVE-1999-0929: Medium severity Novell Http Server vulnerability

Published Jun 16, 1999

Updated

Novell NetWare with Novell-HTTP-Server or YAWN web servers allows remote attackers to conduct a denial of service via a large number of HTTP GET requests.

Affected Software

4 affected components

Novell Http Server=2.51r1

Novell Http Server=3.1r1

Novell Netware=4.1

Novell Netware=4.11

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Remove
Remove Novell-HTTP-Server / YAWN from your environment.
Uninstall the Novell-HTTP-Server or YAWN web server if the web service is not needed on the system to eliminate the attack surface for GET-request DoS.
Configuration
If the HTTP service is not required, disable the Novell-HTTP-Server or YAWN web server to remove exposure to remote HTTP GET request floods.
Novell-HTTP-Server / YAWN http_service_enabled = false
Compensating control
Restrict access to the HTTP service using network firewall rules or ACLs to allow only trusted IP ranges to reach the web server, preventing remote attackers from sending large numbers of HTTP GET requests.
Compensating control
Deploy a web application firewall or edge rate-limiter to limit the rate of HTTP GET requests per client/IP and mitigate denial-of-service from request floods.
Operational
Monitor web server logs and network traffic for unusually high rates of HTTP GET requests; identify and block offending IP addresses and update firewall/WAF rules accordingly.

Event History

Jun 16, 1999

CVE Published

04:00 AM

Data Sourced

via NVD·04:00 AM

DescriptionSeverityAffected Software

Feb 4, 2000

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-1999-0929?

CVE-1999-0929 is considered a denial of service vulnerability.

How do I fix CVE-1999-0929?

To fix CVE-1999-0929, ensure that your Novell NetWare and associated HTTP servers are updated to the latest versions available.

What systems are affected by CVE-1999-0929?

CVE-1999-0929 affects Novell NetWare versions 4.1 and 4.11 and Novell HTTP Server versions 2.51r1 and 3.1r1.

Can CVE-1999-0929 be exploited remotely?

Yes, CVE-1999-0929 can be exploited remotely through a large number of HTTP GET requests.

What are the potential impacts of CVE-1999-0929?

The potential impact of CVE-1999-0929 includes disruption of service to legitimate users by overwhelming the server.