Quick answers
- Is CVE-1999-0572 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-1999-0572 being exploited in the wild.
- How severe is CVE-1999-0572?
- Critical severity, with a CVSS score of 9.3, published 1 January 1997.
- Which products and versions are affected?
- Microsoft Windows NT NT 4.0 and earlier.
- Is there a fix for CVE-1999-0572?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-1999-0572 attacked?
- It is attacked over the network, in an operating system.
- Am I affected by CVE-1999-0572?
- Check whether you run Microsoft Windows 2000 or Microsoft Windows Nt. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability stems from the default file association of the .reg extension with the Windows Registry Editor (regedit.exe) in Windows NT. When a user opens a .reg file, the system automatically imports the contained registry keys and values without sufficient warning or isolation. An attacker can exploit this by delivering a malicious .reg file via email or web download (social engineering). Successful exploitation allows the attacker to modify critical system settings, disable security features, or ensure the execution of malicious code upon the next system boot. This is classified as a Trojan Horse attack vector due to the reliance on user interaction to execute the file.
Affected products
- Microsoft Windows NT NT 4.0 and earlier
Timeline
- 1997-01-01: disclosed