CVE-1999-1474: High severity Microsoft PowerPoint vulnerability
PowerPoint 95 and 97 allows remote attackers to cause an application to be run automatically without prompting the user, possibly through the slide show, when the document is opened in browsers such as Internet Explorer.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Configure Internet Explorer to prevent opening PowerPoint documents inline (do not render PPT/PPTX inside the browser); force downloads so files can be scanned and opened only in a desktop PowerPoint instance.
Internet Explorer open PowerPoint documents in browser = disabled - Compensating control
Block or quarantine PowerPoint documents from untrusted sources at email gateways, web proxies, or network perimeter controls to prevent documents being opened in-browser (e.g., by Internet Explorer). Scan such documents for malicious content before delivery.
- Operational
Advise users not to open PowerPoint documents from untrusted sources or inside browsers such as Internet Explorer; if a suspicious document was opened, investigate on an isolated system and treat as potentially malicious.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-1474?
CVE-1999-1474 is classified as a high severity vulnerability due to its potential to allow arbitrary code execution without user consent.
What versions of PowerPoint are affected by CVE-1999-1474?
CVE-1999-1474 affects Microsoft PowerPoint versions 95 and 97.
How do I fix CVE-1999-1474?
To fix CVE-1999-1474, users should upgrade to a more secure version of Microsoft PowerPoint that is not vulnerable to this exploit.
Can CVE-1999-1474 be exploited in web browsers?
Yes, CVE-1999-1474 can be exploited in web browsers such as Internet Explorer when opening vulnerable PowerPoint documents.
What kind of attack does CVE-1999-1474 facilitate?
CVE-1999-1474 facilitates remote code execution attacks by allowing malicious PowerPoint presentations to run without user interaction.