CVE-1999-1052: Medium severity microsoft frontpage vulnerability
Microsoft FrontPage stores form results in a default location in /private/formresults.txt, which is world-readable and accessible in the document root, which allows remote attackers to read possibly sensitive information submitted by other users.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Configure FrontPage so form results are stored outside the web document root (do not store results in /_private/form_results.txt in the site root).
Microsoft Office FrontPage form_results_storage_location = outside document root - Configuration
Change file system permissions on form results so the file is not world-readable (remove public/read access and restrict to the web server or administrator accounts only).
Microsoft Office FrontPage form_results_file_permissions = not world-readable - Compensating control
Configure the web server or site access controls to deny HTTP access to /_private/form_results.txt and the /_private directory (for example, return 403 or restrict access to trusted IPs) to prevent remote reads.
- Operational
Search the document root for any existing /_private/form_results.txt files, securely delete or move them outside the document root, and sanitize any sensitive data contained within.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-1052?
CVE-1999-1052 is considered a critical vulnerability due to the potential exposure of sensitive information.
How do I fix CVE-1999-1052?
To fix CVE-1999-1052, you should change the permissions of the /_private/form_results.txt file to prevent unauthorized access.
What systems are impacted by CVE-1999-1052?
CVE-1999-1052 affects Microsoft FrontPage installations where form results are stored in the default location.
What type of information can be exposed by CVE-1999-1052?
CVE-1999-1052 can expose sensitive information submitted by users through forms processed by Microsoft FrontPage.
Is CVE-1999-1052 still a risk today?
While CVE-1999-1052 is an older vulnerability, it remains a risk in environments still using outdated Microsoft FrontPage software.