CVE-1999-1357: High severity Netscape Communicator vulnerability
Netscape Communicator 4.04 through 4.7 (and possibly other versions) in various UNIX operating systems converts the 0x8b character to a "<" sign, and the 0x9b character to a ">" sign, which could allow remote attackers to attack other clients via cross-site scripting (CSS) in CGI programs that do not filter these characters.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Ensure CGI programs properly filter or HTML-encode the raw byte values 0x8b and 0x9b (so they are not emitted as characters that can be transformed into '<' or '>') before including user-supplied data in HTML responses.
CGI programs / web application output encoding filter/escape 0x8b and 0x9b bytes = escape or remove - Operational
Audit existing CGI scripts and web applications for places where untrusted input is included in HTML output; patch or update those scripts to apply proper output encoding/escaping for HTML contexts and re-test to confirm the characters 0x8b and 0x9b cannot lead to injected '<' or '>' characters.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-1357?
CVE-1999-1357 has been classified as a moderate severity vulnerability.
What does CVE-1999-1357 affect?
CVE-1999-1357 affects Netscape Communicator versions 4.04 through 4.7 on various UNIX operating systems.
How do I fix CVE-1999-1357?
To mitigate CVE-1999-1357, upgrade to a version of Netscape Communicator that is beyond 4.7.
What types of attacks can CVE-1999-1357 enable?
CVE-1999-1357 can allow remote attackers to exploit cross-site scripting vulnerabilities in CGI programs.
Is CVE-1999-1357 present in Netscape Communicator 4.8?
No, CVE-1999-1357 is not present in Netscape Communicator 4.8 or any later versions.