CVE-1999-1237: Buffer Overflow
Multiple buffer overflows in smbvalid/smbval SMB authentication library, as used in Apache::AuthenSmb and possibly other modules, allows remote attackers to execute arbitrary commands via (1) a long username, (2) a long password, and (3) other unspecified methods.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Apache::AuthenSmbfrom your environment.Uninstall or remove the Apache::AuthenSmb module from the server if it is not required. Remove any LoadModule lines and related authentication configuration to prevent use of the vulnerable SMB authentication integration.
- Remove
Remove
smbvalid/smbvalfrom your environment.Uninstall the smbvalid/smbval SMB authentication library from systems using it (or replace it with a non-vulnerable alternative) to eliminate the vulnerable code paths used by Apache::AuthenSmb and other modules.
- Configuration
Disable SMB-based authentication in Apache configuration (remove or comment out configuration that invokes Apache::AuthenSmb and prevent the module from being loaded) until a fixed version or patch is available.
Apache::AuthenSmb enabled = false - Compensating control
Restrict network access to systems and services that rely on smbvalid/smbval or Apache::AuthenSmb (limit to trusted hosts/networks via firewall, ACLs or other network controls) to reduce exposure to remote attackers until the vulnerability is remediated.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-1237?
CVE-1999-1237 has a high severity due to the potential for remote command execution.
How do I fix CVE-1999-1237?
To fix CVE-1999-1237, update the affected software to a version that addresses the buffer overflow vulnerabilities.
Which software is affected by CVE-1999-1237?
CVE-1999-1237 affects the Apache HTTP Server and potentially other modules using the smbvalid/smbval SMB authentication library.
What types of attacks can exploit CVE-1999-1237?
CVE-1999-1237 can be exploited through attacks that supply overly long usernames or passwords during authentication.
Are there any known exploits for CVE-1999-1237?
Yes, there are known exploits for CVE-1999-1237 that leverage the buffer overflow conditions to execute arbitrary commands.