High severity · published May 6, 1997
CVE-1999-0039
webdist CGI program (webdist.cgi) in SGI IRIX allows remote attackers to execute arbitrary commands via shell metacharacters in the distloc parameter
7.3
CVSS
16.2%
EPSS
No
On KEV
Description
webdist CGI program (webdist.cgi) in SGI IRIX allows remote attackers to execute arbitrary commands via shell metacharacters in the distloc parameter.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)16.2% · higher than 97% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IR
Irix · Sgi
5.0; 5.1; 5.2; 5.3; 6.1; 6.2; +1 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-1999-0039
CVE.org
https://www.cve.org/CVERecord?id=CVE-1999-0039
US Government Resource
http://www.cert.org/advisories/CA-1997-12.html
www.osvdb.org
http://www.osvdb.org/235
www.securityfocus.com
http://www.securityfocus.com/bid/374
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/333
More from Irix
9.8
CVE-2003-0174
The LDAP name service (nsd) in IRIX 6.5.19 and earlier does not properly verify if the USERPASSWORD attribute has been provided by an LDAP server, which could allow attackers to…
9.8
CVE-2001-0249
Heap overflow in FTP daemon in Solaris 8 allows remote attackers to execute arbitrary commands by creating a long pathname and calling the LIST command, which uses glob to…
9.8
CVE-2001-0248
Buffer overflow in FTP server in HPUX 11 allows remote attackers to execute arbitrary commands by creating a long pathname and calling the STAT command, which uses glob to…
8.4
CVE-1999-0029
root privileges via buffer overflow in ordist command on SGI IRIX systems
8.4
CVE-1999-0036
IRIX login program with a nonzero LOCKOUT parameter allows creation or damage to files