CVE-1999-1367: Medium severity Microsoft Internet Explorer vulnerability
Internet Explorer 5.0 does not properly reset the username/password cache for Web sites that do not use standard cache controls, which could allow users on the same system to access restricted web sites that were visited by other users.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Internet Explorer 5.0from your environment.Uninstall Internet Explorer 5.0 if it is not required on the system.
- Compensating control
Avoid using Internet Explorer 5.0 on multi-user or shared systems. Require users to log off or reboot between different users and restrict physical and account access to systems where IE 5.0 is present.
- Compensating control
For affected websites: ensure they send and honor standard cache-control headers (do not allow caching of authenticated pages) so credentials and sensitive pages are not stored in the browser cache.
- Operational
Clear Internet Explorer's username/password cache and browser cache before another user uses the same system to ensure credentials from prior sessions are not accessible.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-1367?
CVE-1999-1367 has been classified as a medium severity vulnerability due to the potential unauthorized access to restricted websites.
How do I fix CVE-1999-1367?
To fix CVE-1999-1367, users should upgrade from Internet Explorer 5.0 to a later version that correctly handles username/password caching.
What is the impact of CVE-1999-1367?
The impact of CVE-1999-1367 could allow unauthorized users on the same system to access web pages that were previously visited by other users.
Which software is affected by CVE-1999-1367?
CVE-1999-1367 specifically affects Internet Explorer version 5.0.
Can CVE-1999-1367 be exploited remotely?
CVE-1999-1367 does not allow for remote exploitation as it requires local access to the affected system to exploit the cached credentials.