CVE-1999-1093: Buffer Overflow
Buffer overflow in the Window.External function in the JScript Scripting Engine in Internet Explorer 4.01 SP1 and earlier allows remote attackers to execute arbitrary commands via a malicious web page.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Internet Explorerfrom your environment.If Internet Explorer is not required, uninstall or remove it from affected systems or block its use to eliminate exposure to the vulnerable JScript Window.External functionality.
- Configuration
Disable Active Scripting or otherwise disable the JScript scripting engine in Internet Explorer to prevent execution of malicious Window.External calls (use browser security settings or enterprise policy controls).
Internet Explorer (JScript Scripting Engine) Active scripting / JScript execution = Disabled - Compensating control
Restrict access to untrusted or potentially malicious web pages at the network layer (firewall, proxy, web gateway or WAF) and limit Internet Explorer usage to trusted hosts only.
- Operational
If compromise is suspected due to this vulnerability, investigate affected hosts for signs of exploitation, rebuild or remediate compromised systems, and rotate any credentials that may have been exposed.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-1093?
CVE-1999-1093 is classified as a critical vulnerability due to its potential to allow remote code execution.
How do I fix CVE-1999-1093?
To fix CVE-1999-1093, it is recommended to upgrade to a version of Internet Explorer later than 4.01 SP1.
What versions of Internet Explorer are affected by CVE-1999-1093?
CVE-1999-1093 affects Internet Explorer 4.0 and 4.01 SP1 and earlier versions.
What type of attack does CVE-1999-1093 enable?
CVE-1999-1093 enables remote attackers to execute arbitrary commands by exploiting a buffer overflow.
Is CVE-1999-1093 still a risk today?
While CVE-1999-1093 primarily affects outdated versions of Internet Explorer, running any vulnerable software poses a security risk.