CVE-1999-1069: Medium severity icat electronic commerce suite vulnerability
Directory traversal vulnerability in carbo.dll in iCat Carbo Server 3.0.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the icatcommand parameter.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Icat Carbo Server (carbo.dll)from your environment.If the Carbo Server component is not required, uninstall or disable the Icat Carbo Server component or remove/disable carbo.dll to eliminate the vulnerable code path.
- Configuration
Implement input validation or application configuration to sanitize or reject any '..' (dot-dot) sequences in the icatcommand parameter so path traversal is not possible.
Icat Carbo Server (carbo.dll) icatcommand parameter handling = reject any ".." sequences - Compensating control
Restrict network access to the Carbo Server to trusted hosts (firewall, ACLs) and/or deploy WAF rules to block HTTP requests where the icatcommand parameter contains '..' or other path-traversal patterns; also enforce least-privilege filesystem permissions for the process to limit exposure if a read occurs.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-1069?
CVE-1999-1069 is classified as a high severity vulnerability due to its potential to allow unauthorized access to sensitive files.
How do I fix CVE-1999-1069?
To fix CVE-1999-1069, upgrade to a version of iCat Carbo Server that is not affected, or implement input validation to sanitize file path inputs.
What is the impact of CVE-1999-1069?
The impact of CVE-1999-1069 allows remote attackers to read arbitrary files on the server, potentially exposing sensitive data.
Which software versions are affected by CVE-1999-1069?
CVE-1999-1069 affects iCat Electronic Commerce Suite version 3.0.0.
How can an attacker exploit CVE-1999-1069?
An attacker can exploit CVE-1999-1069 by manipulating the icatcommand parameter to include a '..' sequence for directory traversal.