CVE-1999-0266

Vulnerability

The info2www CGI script, which provides HTTP access to GNU EMACS Info Nodes, fails to properly parse input. This vulnerability allows for remote command execution on the server with the privileges of the web server process. Affected versions are not explicitly stated but the exploit targets versions 1.0 and 1.1 [1].

Exploitation

An attacker can exploit this vulnerability by sending specially crafted input as part of a variable to the info2www script. This can be done remotely via an HTTP request, for example, by including commands within the URL that are intended to be executed by the script [1].

Impact

A successful exploitation allows an attacker to execute arbitrary commands on the server. The potential consequences include anything the web server process has permissions to do, such as web site defacement or reading sensitive files like /etc/passwd [1].

Mitigation

No specific patched version or release date is disclosed in the available references. Users are advised to disable or remove the info2www script if it is not essential. If the script must remain enabled, it should be secured to prevent unauthorized access and command injection [1].