CVE-1999-1234: Medium severity Microsoft Windows NT vulnerability
LSA (LSASS.EXE) in Windows NT 4.0 allows remote attackers to cause a denial of service via a NULL policy handle in a call to (1) SamrOpenDomain, (2) SamrEnumDomainUsers, and (3) SamrQueryDomainInfo.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict or block remote access to the LSASS (LSA) RPC/SAMR interface that exposes SamrOpenDomain, SamrEnumDomainUsers, and SamrQueryDomainInfo. Implement network-level controls (firewall rules, ACLs, or host-based firewall) to allow RPC/SAMR access only from trusted management hosts to prevent remote exploitation.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-1234?
CVE-1999-1234 is categorized as a denial-of-service vulnerability that affects Windows NT 4.0.
How do I fix CVE-1999-1234?
To mitigate the effects of CVE-1999-1234, it is recommended to upgrade to a newer version of Windows or apply any relevant patches provided by Microsoft.
What systems are affected by CVE-1999-1234?
CVE-1999-1234 specifically affects Microsoft Windows NT version 4.0.
What type of attack does CVE-1999-1234 involve?
CVE-1999-1234 involves remote attackers causing a denial of service through malformed calls to specific functions in the Local Security Authority.
Can CVE-1999-1234 be exploited remotely?
Yes, CVE-1999-1234 can be exploited by remote attackers, allowing them to disrupt services on affected Windows NT 4.0 systems.