CVE-1999-1094: Buffer Overflow
Buffer overflow in Internet Explorer 4.01 and earlier allows remote attackers to execute arbitrary commands via a long URL with the "mk:" protocol, aka the "MK Overrun security issue."
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable or unregister the 'mk:' URL protocol handler in Internet Explorer so the browser will not process mk: URLs (remove the association/handler for the mk: scheme).
Internet Explorer mk: protocol handler = disabled - Compensating control
Block or filter mk: scheme URLs at the network perimeter (proxy, web filter, WAF or gateway) to prevent clients from receiving or following long mk: URLs that could trigger the overflow.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-1094?
CVE-1999-1094 is considered a critical vulnerability due to the potential for remote code execution.
How do I fix CVE-1999-1094?
To mitigate CVE-1999-1094, users should upgrade to a later version of Internet Explorer that is not affected by this buffer overflow.
What systems are affected by CVE-1999-1094?
CVE-1999-1094 affects Internet Explorer version 4.01 and earlier.
What type of vulnerability is CVE-1999-1094?
CVE-1999-1094 is classified as a buffer overflow vulnerability.
Can CVE-1999-1094 be exploited remotely?
Yes, CVE-1999-1094 can be exploited remotely through crafted URLs using the "mk:" protocol.