CVE-1999-1110: Medium severity Microsoft Internet Explorer vulnerability
Windows Media Player ActiveX object as used in Internet Explorer 5.0 returns a specific error code when a file does not exist, which allows remote malicious web sites to determine the existence of files on the client.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Internet Explorer / Windows Media Player ActiveX objectfrom your environment.Unregister or remove the Windows Media Player ActiveX control from affected hosts if it is not required (for example by unregistering the ActiveX DLL/OCX or uninstalling Windows Media Player).
- Configuration
Disable or prompt execution of the Windows Media Player ActiveX control in Internet Explorer security settings (Internet Options → Security → Custom level… set relevant ActiveX controls to 'Disable' or 'Prompt').
Internet Explorer / Windows Media Player ActiveX object ActiveX execution = disabled or prompt - Compensating control
Prevent untrusted web sites from invoking ActiveX controls by restricting web access using browser policies, proxy/web filter rules, or firewall rules; restrict access to untrusted sites and only allow trusted sites to run ActiveX content.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-1110?
CVE-1999-1110 is considered a medium severity vulnerability due to the potential for information disclosure.
How do I fix CVE-1999-1110?
To mitigate CVE-1999-1110, users should upgrade to a later version of Internet Explorer or disable the ActiveX controls in Internet Explorer 5.0.
What does CVE-1999-1110 exploit?
CVE-1999-1110 exploits the Windows Media Player ActiveX object to allow web sites to detect the existence of files on the client machine.
Who is affected by CVE-1999-1110?
CVE-1999-1110 primarily affects users of Internet Explorer 5.0 running on Windows operating systems.
Can CVE-1999-1110 be exploited remotely?
Yes, CVE-1999-1110 can be exploited remotely through malicious web sites that utilize the error code returned by the ActiveX object.