| Vulnerability Name: | CVE-1999-0520 (CCN-2) |
| Assigned: | 1999-08-03 |
| Published: | 1999-08-03 |
| Updated: | 2022-08-17 |
| Summary: | A system-critical NETBIOS/SMB share has inappropriate access control.
|
| CVSS v3 Severity: | 6.5 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)| Exploitability Metrics: | Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None | | Scope: | Scope (S): Unchanged
| | Impact Metrics: | Confidentiality (C): Low
Integrity (I): Low
Availibility (A): None |
|
| CVSS v2 Severity: | 6.4 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N)| Exploitability Metrics: | Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None | | Impact Metrics: | Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): None |
6.4 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N)| Exploitability Metrics: | Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
| | Impact Metrics: | Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): None |
|
| Vulnerability Type: | CWE-Other
|
| Vulnerability Consequences: | Gain Access |
| References: | Source: MITRE
Type: CNA
CVE-1999-0519
Source: MITRE
Type: CNA
CVE-1999-0520
Source: XF
Type: UNKNOWN
nt-netbios-guestaccess(2)
Source: MISC
Type: UNKNOWN
https://exchange.xforce.ibmcloud.com/vulnerabilities/3
|
| Vulnerable Configuration: | Configuration CCN 1:
cpe:/o:microsoft:windows_nt:4.0:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows_2000:*:*:*:*:*:*:*:*AND cpe:/o:microsoft:windows:xp:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows_vista:*:*:*:*:*:*:*:*OR cpe:/a:microsoft:windows_2003:*:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows_7:*:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows_server_2008:*:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows_server_2008:r2:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows_server_2012:*:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows_8:*:*:*:*:*:*:*:*
 Denotes that component is vulnerable |
| Vulnerability Name: | CVE-1999-0520 (CCN-3) |
| Summary: | An SMB share was detected with no password required for full access. In some cases, an attacker can use these shares to gain access to the entire hard drive. It is common to find shares with all access enabled, since this is the default when the share is created. It is best to explicitly set the access control list on all shares. |
| CVSS v3 Severity: | |
| CVSS v2 Severity: | 6.4 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N)| Exploitability Metrics: | Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None | | Impact Metrics: | Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): None |
|
| Vulnerability Consequences: | Gain Privileges |
| References: | Source: MITRE
Type: CNA
CVE-1999-0519
Source: MITRE
Type: CNA
CVE-1999-0520
Source: CCN
Type: CERT Advisory CA-2003-08
Increased Activity Targeting Windows Shares
Source: CCN
Type: CIAC Information Bulletin N-053
Increased Activity Targeting Microsoft Windows Shares
Source: XF
Type: UNKNOWN
nt-netbios-allaccess(3)
|
| Vulnerable Configuration: | Configuration CCN 1:
cpe:/o:microsoft:windows:3.11:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows_95:*:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows_nt:4.0:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows_98:*:*:*:*:*:*:*:*OR cpe:/a:novell:netware:*:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows_98se:*:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows_2000:*:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows_me:*:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows:xp:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows:2003_server:*:*:*:*:*:*:*AND cpe:/o:ibm:aix:*:*:*:*:*:*:*:*OR cpe:/o:windriver:bsdos:*:*:*:*:*:*:*:*OR cpe:/o:hp:hp-ux:*:*:*:*:*:*:*:*OR cpe:/o:sgi:irix:*:*:*:*:*:*:*:*OR cpe:/o:linux:linux_kernel:*:*:*:*:*:*:*:*OR cpe:/o:sun:solaris:*:*:*:*:*:*:*:*OR cpe:/o:ibm:os2:*:*:*:*:*:*:*:*OR cpe:/a:data_general:dg_ux:*:*:*:*:*:*:*:*OR cpe:/o:sco:unix:*:*:*:*:*:*:*:*OR cpe:/o:compaq:tru64:*:*:*:*:*:*:*:*OR cpe:/o:apple:mac_os:*:*:*:*:*:*:*:*
Denotes that component is vulnerable |
| Vulnerability Name: | CVE-1999-0520 (CCN-15) |
| Summary: | An SMB share was found to be open and accessible to any valid user, as well as a null session. The absence of an access control list permits attackers to access the shared resource (drive).
Note: Windows XP Service Pack 2, Windows Server 2003, and Windows Vista are potentially vulnerable but do not allow network access from a null session by default. |
| CVSS v3 Severity: | |
| CVSS v2 Severity: | 6.4 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N)| Exploitability Metrics: | Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None | | Impact Metrics: | Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): None |
|
| Vulnerability Consequences: | Gain Access |
| References: | Source: MITRE
Type: CNA
CVE-1999-0519
Source: MITRE
Type: CNA
CVE-1999-0520
Source: XF
Type: UNKNOWN
nt-netbios-open(15)
|
| Vulnerable Configuration: | Configuration CCN 1:
cpe:/o:microsoft:windows_95:*:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows_nt:4.0:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows_98:*:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows_98se:*:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows_2000:*:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows_me:*:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows:xp:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows:2003_server:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows_vista:*:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows_7:*:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows_server_2008:*:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows_server_2008:r2:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows_server_2012:*:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows_8:*:*:*:*:*:*:*:*
Denotes that component is vulnerable |
| Vulnerability Name: | CVE-1999-0520 (CCN-19) |
| Summary: | An SMB share has been detected, which allows anyone to access the computer and to write to the share. In some cases, an attacker can use these shares to gain access to the entire hard disk. |
| CVSS v3 Severity: | |
| CVSS v2 Severity: | 6.4 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N)| Exploitability Metrics: | Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None | | Impact Metrics: | Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): None |
|
| Vulnerability Consequences: | Gain Access |
| References: | Source: MITRE
Type: CNA
CVE-1999-0519
Source: MITRE
Type: CNA
CVE-1999-0520
Source: XF
Type: UNKNOWN
everyone-writable-netbios-share(19)
|
| Vulnerable Configuration: | Configuration CCN 1:
cpe:/o:microsoft:windows_95:*:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows_nt:4.0:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows_98:*:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows_98se:*:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows_2000:*:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows_me:*:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows:xp:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows:2003_server:*:*:*:*:*:*:*
Denotes that component is vulnerable |
| Vulnerability Name: | CVE-1999-0520 (CCN-20) |
| Summary: | An SMB share was discovered that allows anyone with Guest, access to the computer to write to the SMB share. |
| CVSS v3 Severity: | |
| CVSS v2 Severity: | 6.4 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N)| Exploitability Metrics: | Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None | | Impact Metrics: | Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): None |
|
| Vulnerability Consequences: | Gain Access |
| References: | Source: MITRE
Type: CNA
CVE-1999-0519
Source: MITRE
Type: CNA
CVE-1999-0520
Source: XF
Type: UNKNOWN
nt-netbios-shareguest(20)
|
| Vulnerable Configuration: | Configuration CCN 1:
cpe:/o:microsoft:windows_95:*:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows_nt:4.0:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows_98:*:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows_98se:*:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows_2000:*:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows_me:*:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows:xp:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows:2003_server:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows_vista:*:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows_7:*:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows_server_2008:*:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows_server_2008:r2:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows_server_2012:*:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows_8:*:*:*:*:*:*:*:*
Denotes that component is vulnerable |
| Vulnerability Name: | CVE-1999-0520 (CCN-26) |
| Summary: | An SMB share has been detected with no authentication required for write access. In some cases, an attacker can use these shares to gain access to the entire hard disk. Because anyone is allowed write access with no verification of user or password, this issue is considered a high risk vulnerability. |
| CVSS v3 Severity: | |
| CVSS v2 Severity: | 6.4 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N)| Exploitability Metrics: | Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None | | Impact Metrics: | Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): None |
|
| Vulnerability Consequences: | Gain Access |
| References: | Source: MITRE
Type: CNA
CVE-1999-0519
Source: MITRE
Type: CNA
CVE-1999-0520
Source: XF
Type: UNKNOWN
nt-writable-netbios(26)
|
| Vulnerable Configuration: | Configuration CCN 1:
cpe:/o:ibm:aix:*:*:*:*:*:*:*:*OR cpe:/o:windriver:bsdos:*:*:*:*:*:*:*:*OR cpe:/o:hp:hp-ux:*:*:*:*:*:*:*:*OR cpe:/o:sgi:irix:*:*:*:*:*:*:*:*OR cpe:/o:linux:linux_kernel:*:*:*:*:*:*:*:*OR cpe:/o:sun:solaris:*:*:*:*:*:*:*:*OR cpe:/a:samba:samba:*:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows:3.11:*:*:*:*:*:*:*OR cpe:/o:ibm:os2:*:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows_95:*:*:*:*:*:*:*:*OR cpe:/a:data_general:dg_ux:*:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows_nt:4.0:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows_98:*:*:*:*:*:*:*:*OR cpe:/a:novell:netware:*:*:*:*:*:*:*:*OR cpe:/o:sco:unix:*:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows_98se:*:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows_2000:*:*:*:*:*:*:*:*OR cpe:/o:cisco:ios:*:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows_me:*:*:*:*:*:*:*:*OR cpe:/o:compaq:tru64:*:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows:xp:*:*:*:*:*:*:*OR cpe:/o:apple:mac_os:*:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows:2003_server:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows_vista:*:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows_7:*:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows_server_2008:*:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows_server_2008:r2:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows_server_2012:*:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows_8:*:*:*:*:*:*:*:*
Denotes that component is vulnerable |
| BACK |