CVE-2000-0064: Medium severity Nortel Contivity vulnerability
cgiproc CGI script in Nortel Contivity HTTP server allows remote attackers to cause a denial of service via a malformed URL that includes shell metacharacters.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Nortel Contivity cgiproc CGIfrom your environment.Remove or rename the cgiproc CGI script from the HTTP server's cgi-bin/document root so it cannot be invoked by remote requests.
- Configuration
Disable the cgiproc CGI script in the Contivity HTTP server configuration (or disable CGI execution for that endpoint) to prevent execution of the vulnerable script that can be triggered by malformed URLs.
Nortel Contivity HTTP server (cgiproc CGI) cgiproc_enabled = false - Compensating control
Restrict access to the Contivity HTTP server and management interface to trusted IP addresses using network ACLs or firewall rules; block or limit external/public access to the HTTP service until the vulnerability is mitigated.
Event History
Frequently Asked Questions
What is the severity of CVE-2000-0064?
CVE-2000-0064 has been classified as a denial of service vulnerability.
How do I fix CVE-2000-0064?
To mitigate CVE-2000-0064, it is recommended to upgrade to a fixed version of the Nortel Contivity or implement input validation on CGI parameters.
What impact does CVE-2000-0064 have on affected systems?
CVE-2000-0064 can allow remote attackers to crash the HTTP server, leading to service disruption.
Which systems are affected by CVE-2000-0064?
CVE-2000-0064 affects Nortel Contivity version 1.0.
Is CVE-2000-0064 easy to exploit?
CVE-2000-0064 can be exploited through simple HTTP requests with malformed URLs, making it relatively easy to trigger.