CVE-1999-1067: Medium severity sgi irix vulnerability
SGI MachineInfo CGI program, installed by default on some web servers, prints potentially sensitive system status information, which could be used by remote attackers for information gathering activities.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
SGI MachineInfo CGIfrom your environment.Uninstall or remove the MachineInfo CGI program and any associated script files from the web server if the functionality is not required.
- Configuration
Disable the MachineInfo CGI in the web server configuration so the CGI is not executed or served.
SGI MachineInfo CGI enabled = false - Compensating control
Restrict access to the MachineInfo CGI endpoint to trusted IP ranges or internal networks using firewalls, web server access controls, or a WAF to prevent remote information gathering.
- Operational
Review web server access logs for requests to the MachineInfo CGI, investigate any suspicious access, and enable monitoring/alerting for attempts to access system status pages.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-1067?
CVE-1999-1067 has a moderate severity level due to its potential for information disclosure.
How do I fix CVE-1999-1067?
To fix CVE-1999-1067, disable or remove the SGI MachineInfo CGI program from your web server.
What systems are affected by CVE-1999-1067?
CVE-1999-1067 affects SGI IRIX version 6.3 systems.
What kind of information does CVE-1999-1067 reveal?
CVE-1999-1067 can reveal sensitive system status information that may be exploited by remote attackers.
Can CVE-1999-1067 lead to further attacks?
Yes, the information gathered through CVE-1999-1067 could be used as a foothold for further attacks.