CVE-1999-0382: High severity Microsoft Windows NT vulnerability
The screen saver in Windows NT does not verify that its security context has been changed properly, allowing attackers to run programs with elevated privileges.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Microsoft Windows NT screen saverfrom your environment.Remove or uninstall any non‑standard/third‑party .scr screen saver files from the system (delete or move .scr files from system directories) to prevent untrusted screen savers from being executed.
- Configuration
Disable the screen saver on affected Windows NT systems to prevent execution of screen saver code that could run with elevated privileges.
Microsoft Windows NT screen saver enabled = false - Compensating control
Restrict write/modify permissions on screen saver files (e.g., %SystemRoot%\System32\*.scr) so only administrators can replace or install .scr files; restrict installation of screen savers to trusted administrators.
- Operational
Investigate systems for evidence of unauthorized programs run with elevated privileges; if compromise is suspected, remediate affected systems (restore from known-good backups or rebuild), and rotate any credentials or secrets that may have been exposed.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-0382?
CVE-1999-0382 is considered a critical vulnerability due to its potential for enabling attackers to run programs with elevated privileges.
How do I fix CVE-1999-0382?
To mitigate CVE-1999-0382, update your Windows NT to the latest available service pack provided by Microsoft.
What systems are affected by CVE-1999-0382?
CVE-1999-0382 affects various versions of Windows NT, including 3.5.1 and 4.0 across multiple service packs.
What are the potential impacts of exploiting CVE-1999-0382?
Exploitation of CVE-1999-0382 may allow an attacker to gain unauthorized access and execute arbitrary code with elevated privileges.
Is there a workaround for CVE-1999-0382 if I cannot apply the patch?
A recommended workaround for CVE-1999-0382 includes disabling the screen saver feature to reduce the risk of exploitation.