CVE-1999-1363: Low severity Microsoft Windows NT vulnerability
Windows NT 3.51 and 4.0 allow local users to cause a denial of service (crash) by running a program that creates a large number of locks on a file, which exhausts the NonPagedPool.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Prevent untrusted local users from running arbitrary programs or accessing the affected system: remove or disable unnecessary local accounts, restrict local logon rights, and enforce least-privilege on user accounts to reduce the risk of a local user causing NonPagedPool exhaustion via many file locks.
- Operational
Detect and stop any process that is creating an unusually large number of file locks (investigate and terminate the offending program) to prevent or mitigate NonPagedPool exhaustion and the resultant denial-of-service.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-1363?
CVE-1999-1363 is considered a denial of service vulnerability that can crash affected systems.
How does CVE-1999-1363 affect Windows NT 3.51 and 4.0?
CVE-1999-1363 allows local users to exhaust the NonPagedPool by creating excessive locks on a file.
What are the affected versions of Windows NT for CVE-1999-1363?
CVE-1999-1363 affects Windows NT versions 3.51 and 4.0.
Is there a patch available for CVE-1999-1363?
As CVE-1999-1363 pertains to legacy systems, Microsoft has not provided a specific patch for this vulnerability.
What can I do to mitigate the risks of CVE-1999-1363?
To mitigate CVE-1999-1363, limit local user permissions and monitor system logs for suspicious activities.