CveMateVulnerability intelligence

CVE-1999-1011: microsoft data_access_components

CVSS: 10.0v2.0HighModified

Published 02-06-2000Last modified 01-08-2024

Vulnerability summary

CVE-1999-1011 is a high (CVSS 10.0) vulnerability in microsoft data_access_components. EPSS estimates a 77.14% chance of exploitation in the next 30 days, higher than 99.5% of scored vulnerabilities. 3 public exploits are recorded.

Overall risk

90/100

0100

Critical · default modelHow is this calculated?

CVSS score

10.0/10

010

High · v2.0 (NVD)

EPSS score

77.14%

0%100%

Critical · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits3exploit-database, metasploit

Timeline

02-06-2000
PublishedVulnerability first disclosed.
01-08-2024
Last modifiedVulnerability information updated.

Description

The Remote Data Service (RDS) DataFactory component of Microsoft Data Access Components (MDAC) in IIS 3.x and 4.x exposes unsafe methods, which allows remote attackers to execute arbitrary commands.

CVSS metrics

1 score · 1 source · 1 version

v2.010.0

EPSS trend

Probability

77.14%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

0.00 pp

From 77.14% on 19-09-2026

19-09-202619-10-2026

EPSS score

77.14%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

3 found

exploit-databaselocalwindowsVerified
Microsoft Data Access Components (MDAC) 2.1 / Microsoft IIS 3.0/4.0 / Microsoft Index Server 2.0 / Microsoft Site Server Commerce Edition 3.0 i386 MDAC - RDS (2)
Maturity: weaponized
exploit-databaseremotewindowsVerified
Microsoft Data Access Components (MDAC) 2.1 / Microsoft IIS 3.0/4.0 / Microsoft Index Server 2.0 / Microsoft Site Server Commerce Edition 3.0 i386 MDAC - RDS (1)
Maturity: weaponized
MetasploitremoteVerified
MS99-025 Microsoft IIS MDAC msadcs.dll RDS Arbitrary Remote Command Execution
exploit/windows/iis/msadc
Maturity: weaponized

Weaknesses

CWE · root cause

CWE-264Permissions, Privileges, and Access ControlsWeaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.

Affected systems

Microsoft4 products

1 vendor · 4 products

References

5 links

docs.microsoft.com/en-us/security-updates/securitybulletins/1999/ms99-025Vendor AdvisoryX Refsource MS
www.securityfocus.com/bid/529VDB EntryX Refsource BID
www.osvdb.org/272VDB EntryX Refsource OSVDB
www.ciac.org/ciac/bulletins/j-054.shtmlThird Party AdvisoryGovernment ResourceX Refsource CIAC
docs.microsoft.com/en-us/security-updates/securitybulletins/1998/ms98-004Vendor AdvisoryX Refsource MS