CVE-1999-0412: High severity Microsoft Internet Information Server vulnerability

Published Feb 19, 1999

Updated

In IIS and other web servers, an attacker can attack commands as SYSTEM if the server is running as SYSTEM and loading an ISAPI extension.

Affected Software

3 affected components

Microsoft Internet Information Server=3.0

Microsoft Internet Information Server=4.0

Microsoft Internet Information Services=2.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Remove
Remove Microsoft IIS ISAPI extensions from your environment.
Uninstall or remove any unneeded or untrusted ISAPI extensions from the server to eliminate attack surface from loaded ISAPI modules.
Configuration
Configure IIS application pools and related services to run under a least-privileged account instead of the SYSTEM account to avoid escalation of ISAPI extension actions to SYSTEM.
Microsoft Internet Information Services (IIS) Service account = Run worker process and services under a non-SYSTEM, least-privileged account
Configuration
Disable ISAPI extension support if not required, or restrict IIS to load only explicitly approved/trusted ISAPI extensions.
Microsoft Internet Information Services (IIS) ISAPI extension loading = Disabled or restricted to trusted extensions only
Compensating control
If IIS must run as SYSTEM or ISAPI extensions must be used, isolate the server and restrict network/management access (firewall, WAF, ACLs) to trusted IPs and administrators to reduce exposure.

Event History

Feb 19, 1999

CVE Published

05:00 AM

Data Sourced

via NVD·05:00 AM

DescriptionSeverityAffected Software

Sep 29, 1999

CVE Published

via MITRE·08:00 AM

Data Sourced

via MITRE·08:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-1999-0412?

CVE-1999-0412 is considered a critical vulnerability due to the potential for an attacker to execute commands as the SYSTEM user.

How do I fix CVE-1999-0412?

To mitigate CVE-1999-0412, it is recommended to upgrade to a newer version of Microsoft Internet Information Server that is not affected by this vulnerability.

Which software versions are affected by CVE-1999-0412?

CVE-1999-0412 affects Microsoft Internet Information Server versions 2.0, 3.0, and 4.0.

What type of attack does CVE-1999-0412 enable?

CVE-1999-0412 enables attackers to execute arbitrary commands on the server with SYSTEM privileges.

Is CVE-1999-0412 specific to IIS?

Yes, CVE-1999-0412 specifically affects Microsoft Internet Information Server and other web servers that load ISAPI extensions.