CVE-1999-1128: Medium severity Microsoft Internet Explorer vulnerability
Internet Explorer 3.01 on Windows 95 allows remote malicious web sites to execute arbitrary commands via a .isp file, which is automatically downloaded and executed without prompting the user.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Internet Explorer 3.01from your environment.Uninstall Internet Explorer 3.01 from affected Windows 95 systems or replace it with a non-vulnerable browser if possible.
- Configuration
Configure Internet Explorer to disable automatic execution of downloaded .isp files or require a user prompt before executing .isp handlers (prevent automatic download-and-execute behavior).
Internet Explorer automatic execution of downloaded .isp files = disabled / prompt - Compensating control
Block or restrict access to untrusted or malicious web sites at the network perimeter (firewall/proxy/WAF) and/or filter/block .isp file downloads to prevent remote sites from delivering .isp files to vulnerable hosts.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-1128?
CVE-1999-1128 is considered a critical vulnerability due to its ability to execute arbitrary commands via compromised .isp files.
How do I fix CVE-1999-1128?
To fix CVE-1999-1128, upgrade from Internet Explorer 3.01 to a more secure version that does not have this vulnerability.
What versions of Internet Explorer are affected by CVE-1999-1128?
CVE-1999-1128 specifically affects Internet Explorer version 3.0.1 running on Windows 95.
What can attackers do with CVE-1999-1128?
With CVE-1999-1128, attackers can remotely execute arbitrary commands on a victim's machine without user consent.
Is CVE-1999-1128 still a threat today?
CVE-1999-1128 is historically significant but poses no current threat as modern systems and browsers have resolved this vulnerability.