CVE-1999-0582: Medium severity Microsoft Windows NT vulnerability
A Windows NT account policy has inappropriate, security-critical settings for lockout, e.g. lockout duration, lockout after bad logon attempts, etc.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Configure the Account lockout duration so that locked accounts remain inaccessible for a defined, non-zero period to mitigate brute-force attempts (adjust value according to organizational policy).
Microsoft Windows 2000 / Microsoft Windows NT account policy Account lockout duration = set to an appropriate non-zero duration - Configuration
Configure the Account lockout threshold to lock an account after a configured number of failed logon attempts (set to a reasonable value >0 appropriate for your environment).
Microsoft Windows 2000 / Microsoft Windows NT account policy Account lockout threshold = set to a threshold greater than zero - Configuration
Configure the Reset account lockout counter interval to a suitable timeframe after which failed logon attempt counters are cleared, balancing usability and security according to organizational requirements.
Microsoft Windows 2000 / Microsoft Windows NT account policy Reset account lockout counter = set to an appropriate interval
Event History
Frequently Asked Questions
What is the severity of CVE-1999-0582?
CVE-1999-0582 is considered a high-severity vulnerability due to its potential to allow unauthorized access through inappropriate account lockout policies.
How do I fix CVE-1999-0582?
To fix CVE-1999-0582, you should review and configure your Windows NT or Windows 2000 account lockout policy to ensure appropriate settings for duration and bad logon attempts.
What systems are affected by CVE-1999-0582?
CVE-1999-0582 affects Microsoft Windows NT and Microsoft Windows 2000 systems.
What are the risks associated with CVE-1999-0582?
The risks associated with CVE-1999-0582 include increased vulnerability to brute-force attacks due to inadequate lockout policies.
Can CVE-1999-0582 lead to account compromise?
Yes, if not addressed, CVE-1999-0582 can lead to account compromise by allowing attackers to exploit weak lockout settings.