CVE-1999-1011: Critical severity Microsoft Data Access Components vulnerability
The Remote Data Service (RDS) DataFactory component of Microsoft Data Access Components (MDAC) in IIS 3.x and 4.x exposes unsafe methods, which allows remote attackers to execute arbitrary commands.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Microsoft Data Access Components (RDS DataFactory)from your environment.Uninstall the RDS DataFactory component (or MDAC if appropriate) from affected servers if the functionality is not required.
- Configuration
Disable the RDS DataFactory component (Remote Data Service) in MDAC/IIS so that its methods are not exposed to remote callers.
Microsoft Data Access Components (RDS DataFactory) RDS DataFactory enabled = false - Compensating control
Restrict network access to the vulnerable hosts and IIS services: block or limit incoming traffic to RDS/IIS endpoints using firewall rules, ACLs, or network segmentation to prevent remote invocation of RDS methods.
- Operational
Investigate affected systems for signs of compromise (unauthorized command execution) and perform incident response remediation (containment, eradication, recovery) before or while applying the above mitigations.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-1011?
CVE-1999-1011 has a high severity due to its ability to allow remote execution of arbitrary commands.
How do I fix CVE-1999-1011?
To fix CVE-1999-1011, it is recommended to update Microsoft Data Access Components to a secure version and restrict access to the affected components.
Which software is affected by CVE-1999-1011?
CVE-1999-1011 affects Microsoft Internet Information Server versions 3.0 and 4.0, Microsoft Data Access Components versions 1.5, 2.0, and 2.1, and Microsoft Site Server 3.0.
What type of vulnerability is CVE-1999-1011?
CVE-1999-1011 is a remote command execution vulnerability that exploits unsafe methods in DataFactory component of RDS.
Can CVE-1999-1011 be exploited without authentication?
Yes, CVE-1999-1011 can be exploited remotely without authentication, making it particularly dangerous.