CVE-1999-1317: Medium severity Microsoft Windows NT vulnerability
Windows NT 4.0 SP4 and earlier allows local users to gain privileges by modifying the symbolic link table in the \?? object folder using a different case letter (upper or lower) to point to a different device.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Prevent unprivileged local users from modifying the symbolic link table in the \?? object folder; ensure only trusted administrative accounts may create or change symbolic links (e.g., enforce suitable ACLs/policies to block unprivileged modifications to \??).
- Compensating control
Apply principle of least privilege on systems running Microsoft Windows NT 4.0 SP4 and earlier: remove or restrict local user accounts and limit interactive/logon rights for non‑trusted users to reduce the risk of local privilege escalation via symbolic link manipulation.
- Operational
Audit the \?? object folder for unexpected or case-variant symbolic links that point to sensitive devices, remove or restore any unauthorized links, and investigate systems where such modifications are found.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-1317?
CVE-1999-1317 has a high severity as it allows local users to gain unauthorized privileges.
How do I fix CVE-1999-1317?
To fix CVE-1999-1317, upgrade Microsoft Windows NT to a version later than 4.0 SP4.
What systems are affected by CVE-1999-1317?
CVE-1999-1317 affects Windows NT 4.0 with Service Pack 4 and earlier.
What type of vulnerability is CVE-1999-1317?
CVE-1999-1317 is a privilege escalation vulnerability.
Can CVE-1999-1317 be exploited remotely?
CVE-1999-1317 requires local access to exploit, so it cannot be exploited remotely.