CVE-1999-0378 in InterScan VirusWall
Summary
by MITRE
InterScan VirusWall for Solaris doesn't scan files for viruses when a single HTTP request includes two GET commands.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 04/18/2026
The vulnerability described in CVE-1999-0378 represents a critical flaw in the InterScan VirusWall for Solaris network security appliance that fundamentally undermines its core protective functionality. This issue specifically affects the application layer filtering capabilities of the security solution, where the system fails to properly process and scan file contents when encountering malformed HTTP requests containing multiple GET commands within a single request packet. The flaw demonstrates a classic example of improper input validation and request parsing that allows malicious actors to bypass security controls through crafted HTTP traffic patterns.
The technical root cause of this vulnerability stems from the software's inadequate handling of HTTP protocol requests that contain multiple GET commands in a single packet. When the InterScan VirusWall receives such malformed requests, its parsing logic incorrectly processes only the first GET command while ignoring subsequent commands, effectively allowing potentially malicious content to pass through the security inspection layer without proper virus scanning. This represents a fundamental failure in the security appliance's protocol handling mechanism and demonstrates poor implementation of HTTP request parsing that violates established security principles for network filtering systems. The vulnerability operates at the application layer and can be categorized under CWE-20, which encompasses improper input validation issues, and specifically relates to CWE-444 which deals with improper handling of HTTP requests.
The operational impact of this vulnerability is severe as it creates a potential backdoor for malware delivery through legitimate network traffic that appears to be normal HTTP requests. Attackers can exploit this weakness by crafting HTTP requests that contain both legitimate and malicious content within the same packet, where the legitimate portion triggers the first GET command and the malicious portion is hidden in the second command that gets ignored by the security appliance. This allows adversaries to bypass virus scanning and potentially deliver malware to protected networks without detection, effectively neutralizing the primary protective function of the InterScan VirusWall. The vulnerability affects the availability and integrity of the security solution's protection mechanisms and can be mapped to ATT&CK technique T1071.004 for application layer protocol usage and T1059.007 for command and scripting interpreter usage in network attacks.
Mitigation strategies for this vulnerability should include immediate deployment of vendor-provided patches or updates that address the HTTP request parsing logic and ensure proper handling of multi-command HTTP requests. Organizations should also implement additional network monitoring to detect anomalous HTTP traffic patterns that may indicate exploitation attempts, and consider deploying multiple layers of security controls to provide defense-in-depth. Network administrators should configure the appliance to reject malformed HTTP requests or implement stricter HTTP protocol compliance checks that prevent the specific pattern of multiple GET commands within single requests. The solution requires careful attention to the appliance's configuration and should be validated through comprehensive security testing to ensure that the fix properly addresses the parsing flaw without introducing new vulnerabilities. Security teams should also conduct regular vulnerability assessments of their network security infrastructure to identify similar parsing and validation issues that may exist in other security appliances or network filtering systems.