CVE-1999-1593: microsoft windows_2000 Link Following

Vulnerability summary

CVE-1999-1593 is a high (CVSS 7.6) Link Following vulnerability in microsoft windows_2000. EPSS estimates a 18.13% chance of exploitation in the next 30 days, higher than 97.1% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 15-01-2009
   PublishedVulnerability first disclosed.
2. 16-09-2024
   Last modifiedVulnerability information updated.

Description

Windows Internet Naming Service (WINS) allows remote attackers to cause a denial of service (connectivity loss) or steal credentials via a 1Ch registration that causes WINS to change the domain controller to point to a malicious server. NOTE: this problem may be limited when Windows 95/98 clients are used, or if the primary domain controller becomes unavailable.

• CWE-59Improper Link Resolution Before File Access ('Link Following')The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.