Quick answers
- Is CVE-1999-0496 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-1999-0496 being exploited in the wild.
- How severe is CVE-1999-0496?
- High severity, with a CVSS score of 7.2, published 1 January 1997.
- Which products and versions are affected?
- Microsoft Windows NT 4.0.
- Is there a fix for CVE-1999-0496?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-1999-0496 attacked?
- It is attacked with local access, in an operating system.
- Am I affected by CVE-1999-0496?
- Check whether you run Microsoft Windows Nt. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This vulnerability, known as 'GetAdmin', is a privilege escalation flaw within the Windows NT 4.0 kernel. It occurs because the NtOpenProcessToken system call can be manipulated to succeed regardless of the calling user's actual permissions. A local attacker with standard user access can exploit this root cause to obtain a token with administrative privileges. This allows for a complete bypass of the operating system's access control mechanisms (CWE-264). The attack requires local access to the system but no special user interaction or prior administrative rights. Microsoft addressed this issue in legacy service packs for Windows NT 4.0.
Affected products
- Microsoft Windows NT 4.0
Timeline
- 1997-01-01: disclosed: Initial publication date in NVD record