CVE-1999-1412: Medium severity Apache HTTP Server vulnerability
A possible interaction between Apple MacOS X release 1.0 and Apache HTTP server allows remote attackers to cause a denial of service (crash) via a flood of HTTP GET requests to CGI programs, which generates a large number of processes.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable CGI support or remove/disable CGI scripts if they are not required to prevent HTTP GET request floods from spawning large numbers of processes.
Apache HTTP Server CGI enabled = disable - Configuration
Configure the server to limit the number of child processes/threads and to restrict the rate at which CGI programs can be spawned to prevent process exhaustion from request floods.
Apache HTTP Server process spawning limits = limit - Compensating control
Apply network-level mitigations such as rate limiting, a web application firewall (WAF), or firewall/ACL rules to throttle or block excessive HTTP GET requests targeting CGI endpoints.
- Operational
Monitor for abnormal process growth and, if an attack occurs, terminate excessive processes and restart the Apache service/host to recover from the denial-of-service condition.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-1412?
CVE-1999-1412 is classified as a denial of service vulnerability that can significantly disrupt service availability.
How do I fix CVE-1999-1412?
To mitigate CVE-1999-1412, ensure that Apache HTTP server is properly configured to limit the number of processes spawned by CGI scripts.
What software is affected by CVE-1999-1412?
CVE-1999-1412 affects Apple MacOS X release 1.0 and the Apache HTTP server.
What type of attack does CVE-1999-1412 describe?
CVE-1999-1412 describes a denial of service attack facilitated by overwhelming HTTP GET requests to CGI programs.
Can CVE-1999-1412 be exploited remotely?
Yes, attackers can exploit CVE-1999-1412 remotely by sending a flood of requests to the vulnerable server.