CVE-1999-0376: Medium severity Microsoft Windows NT vulnerability
Local users in Windows NT can obtain administrator privileges by changing the KnownDLLs list to reference malicious programs.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Ensure the registry value HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\KnownDLLs is writable only by administrators. Remove or deny write permissions for local non-administrator accounts so they cannot modify the KnownDLLs list.
Windows NT registry (KnownDLLs) Permissions / write access = Administrators only (remove write for non-administrator accounts) - Compensating control
Apply least-privilege controls for local accounts: remove unnecessary local user privileges, do not grant administrative rights to standard users, and restrict the ability of local users to install or register DLLs until the registry permissions and system integrity are verified.
- Operational
Audit the KnownDLLs registry entry for unauthorized or malicious entries and restore it to known-good values. If unauthorized modification is detected, investigate scope of compromise, remove any malicious binaries, and remediate impacted systems (restore from trusted backups or perform full system recovery) before re-enabling normal operations.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-0376?
CVE-1999-0376 has a high severity rating due to potential privilege escalation for local users.
How do I fix CVE-1999-0376?
To mitigate CVE-1999-0376, ensure that only trusted applications are listed in the KnownDLLs registry key.
What versions of Windows NT are affected by CVE-1999-0376?
CVE-1999-0376 affects Windows NT versions 3.5.1 and 4.0, including various service packs.
Can CVE-1999-0376 be exploited remotely?
CVE-1999-0376 is not a remote vulnerability; it requires local access to exploit.
What type of vulnerability is CVE-1999-0376?
CVE-1999-0376 is a local privilege escalation vulnerability that allows unauthorized access to administrator-level privileges.