CVE-1999-1005: Medium severity Netscape Enterprise server vulnerability
Groupwise web server GWWEB.EXE allows remote attackers to read arbitrary files with .htm extensions via a .. (dot dot) attack using the HELP parameter.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Novell GroupWise (web server GWWEB.EXE)from your environment.Uninstall or disable the GroupWise web server component (GWWEB.EXE) if the web interface is not required.
- Configuration
Disable the HELP parameter in GWWEB.EXE or implement strict input validation to reject any '..' directory-traversal sequences and ensure only intended .htm files in allowed directories can be served.
Novell GroupWise web server (GWWEB.EXE) HELP parameter handling = disabled or input-validated to block '..' sequences and limit served extensions - Compensating control
Restrict access to the GroupWise web server (GWWEB.EXE) with network controls (firewall, ACLs, or reverse proxy) to trusted IPs only, and block requests that contain directory-traversal patterns (e.g., '..') or that attempt to access .htm files via the HELP parameter.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-1005?
CVE-1999-1005 is considered to have a moderate severity level due to the potential for unauthorized file access.
How do I fix CVE-1999-1005?
To fix CVE-1999-1005, you should patch the affected version of the GroupWise web server or implement access controls to prevent directory traversal attacks.
What software is affected by CVE-1999-1005?
CVE-1999-1005 affects Netscape Enterprise Server version 3.0.7a and Novell GroupWise versions 5.2 and 5.5.
Can CVE-1999-1005 be exploited remotely?
Yes, CVE-1999-1005 can be exploited remotely by attackers to read arbitrary files on the server.
What is a '..' (dot dot) attack as related to CVE-1999-1005?
A '..' (dot dot) attack refers to a directory traversal attack that allows attackers to navigate to parent directories to access restricted files.