CVE-1999-0824: Medium severity Microsoft Windows NT vulnerability
A Windows NT user can use SUBST to map a drive letter to a folder, which is not unmapped after the user logs off, potentially allowing that user to modify the location of folders accessed by later users.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Ensure SUBST-created drive mappings are removed when the creating user logs off. Implement a logoff mechanism (for example, a logoff script or session cleanup) that unmaps any SUBST drive letters so mappings do not persist for later users.
Windows NT (SUBST) unmap_subst_on_logoff = enabled - Compensating control
Limit or control who can create SUBST mappings (for example restrict to administrators or enforce via policy) and/or enforce filesystem ACLs to prevent redirected folders from being modified by later users.
- Operational
Scan systems for existing SUBST mappings, remove any found substituted drive letters, and verify mappings are not persisting across user sessions.
Event History
Frequently Asked Questions
What is the vulnerability associated with CVE-1999-0824?
CVE-1999-0824 allows a Windows NT user to map a drive letter to a folder using SUBST, which may not be unmapped after logout, posing a risk for later users.
What versions of Windows NT are affected by CVE-1999-0824?
CVE-1999-0824 affects all versions of Microsoft Windows NT 4.0, including service packs SP1 through SP6.
What are the potential risks of CVE-1999-0824?
The risks of CVE-1999-0824 include unauthorized access and modification of files in folders accessed by future users.
How can I mitigate the risk of CVE-1999-0824?
To mitigate CVE-1999-0824, ensure that users are not allowed to use the SUBST command or consider logging off users properly to clear mapped drives.
Is there a patch available for CVE-1999-0824?
There is no specific patch for CVE-1999-0824, but best practices in user management can help mitigate the risks.