CVE-2000-0182: Medium severity iPlanet iPlanet Web Server vulnerability
iPlanet Web Server 4.1 allows remote attackers to cause a denial of service via a large number of GET commands, which consumes memory and causes a kernel panic.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Sun iPlanet Web Serverfrom your environment.Uninstall the Sun iPlanet Web Server if it is not required, or replace it with a supported alternative.
- Configuration
Configure the web server or a front-end proxy/load balancer to limit the number of HTTP GET requests per client and to enforce global request-rate limits to prevent memory exhaustion from a large number of GET commands.
Sun iPlanet Web Server HTTP GET rate limiting = limit excessive requests per client/IP - Configuration
Lower keepalive timeouts and reduce the maximum number of concurrent connections/requests to decrease memory usage under high request loads.
Sun iPlanet Web Server keepalive timeout and max connections = reduce timeout and cap concurrent connections - Compensating control
Deploy a WAF, rate-limiting proxy, or perimeter firewall rules to detect, throttle, or block abusive patterns of repeated GET requests and restrict access to the server from untrusted networks.
- Operational
Monitor server logs and network traffic for bursts of GET requests and anomalous client behavior; collect crash dumps and restart/recover servers that experience kernel panics. Coordinate with the vendor and apply any vendor-supplied patches when they become available.
Event History
Frequently Asked Questions
What is the severity of CVE-2000-0182?
CVE-2000-0182 is classified as a high severity vulnerability due to its potential to cause a denial of service.
How do I fix CVE-2000-0182?
To fix CVE-2000-0182, it is recommended to upgrade to a newer version of iPlanet Web Server that is not affected by this vulnerability.
What systems are affected by CVE-2000-0182?
CVE-2000-0182 specifically affects iPlanet Web Server 4.1 Enterprise.
What type of attack does CVE-2000-0182 involve?
CVE-2000-0182 involves a denial of service attack that can be executed by sending a large number of GET commands.
What are the consequences of exploiting CVE-2000-0182?
Exploiting CVE-2000-0182 can lead to excessive memory consumption and subsequent kernel panic, resulting in service interruption.