CVE-1999-1195: Medium severity Network Associates Virusscan vulnerability
NAI VirusScan NT 4.0.2 does not properly modify the scan.dat virus definition file during an update via FTP, but it reports that the update was successful, which could cause a system administrator to believe that the definitions have been updated correctly.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable or stop using FTP-based definition updates for NAI VirusScan NT 4.0.2 until a vendor-provided fix is available. Use an alternative update method or manual deployment of definition files if supported.
NAI VirusScan NT 4.0.2 definition_update_method = disable FTP updates - Compensating control
Block or restrict FTP-based update traffic (FTP protocol) from clients to update servers at the network perimeter or via host-based firewalls/ACLs to prevent incomplete or unreliable FTP updates until a patch is provided.
- Operational
After any definition update, manually verify that scan.dat was actually modified (for example, check the file timestamp, size, or perform an integrity/definition check). Do not rely solely on the application's "update successful" message. If scan.dat was not updated, reapply definitions manually or through an alternative trusted channel.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-1195?
CVE-1999-1195 is classified as a medium severity vulnerability due to the false reporting of successful updates.
How do I fix CVE-1999-1195?
To fix CVE-1999-1195, ensure that you manually verify the integrity of the scan.dat file after any FTP update.
Which software versions are affected by CVE-1999-1195?
CVE-1999-1195 affects Network Associates VirusScan version 4.0.2.
What are the risks associated with CVE-1999-1195?
The risks include running outdated virus definitions, potentially exposing systems to unrecognized threats.
Can CVE-1999-1195 lead to further security issues?
Yes, because outdated virus definitions can allow malware to infect the system without detection.