CVE-1999-0995: Input Validation
Windows NT Local Security Authority (LSA) allows remote attackers to cause a denial of service via malformed arguments to the LsaLookupSids function which looks up the SID, aka "Malformed Security Identifier Request."
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict remote access to the Windows NT Local Security Authority (LSA) interfaces that handle LsaLookupSids. Use network firewalls, host-based firewalls or network segmentation to block or allow only trusted management hosts to connect to affected Windows NT systems; isolate these systems from untrusted networks.
- Operational
Monitor Microsoft security advisories for an official patch or fix for Windows NT and apply the vendor-supplied update as soon as it is available. If systems cannot be patched, consider isolating or decommissioning affected Windows NT hosts until a fix is obtained.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-0995?
CVE-1999-0995 is classified as a denial of service vulnerability affecting Windows NT 4.0.
How do I fix CVE-1999-0995?
To mitigate CVE-1999-0995, apply the appropriate patches or updates provided by Microsoft for Windows NT 4.0.
What function is affected by CVE-1999-0995?
CVE-1999-0995 targets the LsaLookupSids function within the Windows NT Local Security Authority.
Can CVE-1999-0995 be exploited remotely?
Yes, CVE-1999-0995 allows remote attackers to exploit malformed requests, leading to a denial of service.
Which versions of Windows NT are vulnerable to CVE-1999-0995?
CVE-1999-0995 affects Windows NT 4.0 and its various editions including server and terminal server versions.