Vulnerability CVE-1999-1011
Published: 1999-07-19   Modified: 2012-02-12

Description:
The Remote Data Service (RDS) DataFactory component of Microsoft Data Access Components (MDAC) in IIS 3.x and 4.x exposes unsafe methods, which allows remote attackers to execute arbitrary commands.

See advisories in our WLB2 database:
Topic
Author
Date
High
Microsoft (win2000) IIS MDAC msadcs.dll RDS Remote Command Execution
patrick
08.06.2012

Type:

CWE-78

 (Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') )

CVSS2 => (AV:N/AC:L/Au:N/C:C/I:C/A:C)

CVSS Base Score
Impact Subscore
Exploitability Subscore
10/10
10/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Complete
Complete
Complete
Affected software
Microsoft -> Data access components 
Microsoft -> Index server 
Microsoft -> Internet information server 
Microsoft -> Site server 

 References:
http://www.ciac.org/ciac/bulletins/j-054.shtml
https://docs.microsoft.com/en-us/security-updates/securitybulletins/1998/ms98-004
https://docs.microsoft.com/en-us/security-updates/securitybulletins/1999/ms99-025
https://www.securityfocus.com/bid/529
Copyright 2024, cxsecurity.com

 

Back to Top