CVE-1999-1217: Medium severity Microsoft Windows NT vulnerability
The PATH in Windows NT includes the current working directory (.), which could allow local users to gain privileges by placing Trojan horse programs with the same name as commonly used system programs into certain directories.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Remove the '.' entry from the system PATH so the current working directory is not searched. Update the system PATH environment variable (via System Properties or the registry) to exclude '.' and ensure changes apply to new sessions.
Microsoft Windows NT (system PATH) include_current_working_directory (.) = remove - Configuration
Ensure directories where system programs are launched are not writable by non-privileged local users. Remove write permissions for standard users and allow only trusted administrators to create or modify executables in those directories.
Windows NT system program directories directory write permissions = restrict to administrators - Operational
Audit systems for Trojan horse programs: search for unauthorized executables whose names match commonly used system program names in directories accessible to local users, remove any confirmed malicious binaries, and restore legitimate files from trusted backups or installation media.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-1217?
CVE-1999-1217 is considered a high-risk vulnerability due to the potential for local users to exploit it for unauthorized privilege escalation.
How do I fix CVE-1999-1217?
Fixing CVE-1999-1217 involves modifying the system PATH variable to exclude the current working directory or implementing strict access controls.
Who is affected by CVE-1999-1217?
Any user operating Windows NT is potentially affected by CVE-1999-1217 if the current working directory is included in the PATH.
What type of attack is associated with CVE-1999-1217?
CVE-1999-1217 is associated with local privilege escalation attacks, where attackers can replace system programs with malicious versions.
Is there a workaround for CVE-1999-1217?
Yes, a workaround for CVE-1999-1217 includes avoiding the use of the current directory in the PATH for non-administrative users.