Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2000-0623: O'Reilly WebSite Professional allows remote code execution

CVE-2000-0623 · published 26 years ago

Summary

The O'Reilly WebSite Professional web server (version 2.4 and earlier) can be tricked into running unwanted commands when it receives an unusually long web request. This could let an attacker take control of the server from a distance. Apply the latest updates from O'Reilly or follow their guidance to patch the server as soon as possible.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
oreilly	website_professional	2.3.18 2.4 2.4.9 `cpe:2.3:a:oreilly:website_professional:2.3.18:::::::*`

Original advisory text

Buffer overflow in O'Reilly WebSite Professional web server 2.4 and earlier allows remote attackers to execute arbitrary commands via a long GET request or Referrer header.

References

http://www.ntbugtraq.com/default.asp?pid=36&sid=1&A2=ind0007&L=ntbugtraq&F=&S=&P... Patch Vendor Advisory
http://www.securityfocus.com/bid/1492 Exploit Patch Vendor Advisory

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker full control (estimated)

Severity

10.0 Critical

Exploitation

5% chance of attack within 30 days

Timeline

Published17 Jul 2000

Updated22 Oct 2026

First seen29 Sep 2026

Sources

CVE-2000-0623 · NVD

Track software like this

Free during beta