CVE-1999-1104 in Windows
Summary
by MITRE
Windows 95 uses weak encryption for the password list (.pwl) file used when password caching is enabled, which allows local users to gain privileges by decrypting the passwords.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 04/20/2026
The vulnerability described in CVE-1999-1104 represents a critical cryptographic weakness in Microsoft Windows 95 operating systems that specifically affects the password caching mechanism. This flaw resides in the implementation of the password list file (.pwl) which is created when users enable password caching for network connections. The vulnerability stems from the use of weak encryption algorithms that were considered acceptable for their time but have since been deemed insufficient for protecting sensitive authentication data. The .pwl file serves as a local storage mechanism that retains cached passwords to facilitate seamless network access without requiring repeated authentication prompts.
The technical implementation of this vulnerability involves the use of a simple encryption scheme that employs a weak key derivation function and basic substitution ciphers. When password caching is enabled, Windows 95 stores user credentials in the .pwl file using encryption that can be easily reversed through brute force attacks or by leveraging known plaintext attacks. The encryption algorithm used in this implementation lacks proper cryptographic strength and does not employ modern encryption standards that would resist contemporary cryptanalytic techniques. This weakness is particularly concerning because it allows local users with access to the system to directly decrypt stored passwords without requiring network access or complex attack vectors.
The operational impact of this vulnerability is significant as it provides local attackers with direct access to user credentials that would otherwise remain protected through proper authentication mechanisms. Once an attacker gains access to the .pwl file, they can easily extract and decrypt stored passwords, potentially gaining access to multiple network resources and accounts. This vulnerability essentially undermines the security model of password caching by providing an attack surface that bypasses the intended protection mechanisms. The impact extends beyond individual user accounts to potentially compromise entire network environments where multiple cached passwords are present, as attackers can aggregate credentials to perform lateral movement and privilege escalation attacks.
From a cybersecurity perspective, this vulnerability aligns with CWE-327 which identifies the use of weak cryptographic algorithms as a security weakness. The flaw also relates to ATT&CK technique T1078 which covers legitimate credentials and T1566 which involves credential access through various attack vectors. Organizations using Windows 95 systems would have been particularly vulnerable to this type of attack, as the operating system's password caching mechanism was not designed with sufficient cryptographic strength to protect against determined local attackers. The vulnerability demonstrates the importance of proper cryptographic implementation and the dangers of using outdated encryption standards even for local file storage. Mitigation strategies would have included disabling password caching, implementing proper file permissions, and ensuring that systems were not accessible to unauthorized local users. This vulnerability highlights the critical need for cryptographic security reviews and the importance of staying current with security best practices in authentication mechanisms.
The broader implications of CVE-1999-1104 extend beyond the immediate technical flaw to represent a fundamental security design issue in legacy systems. This vulnerability serves as a historical example of how cryptographic weaknesses in operating system components can create persistent security risks that remain exploitable long after initial deployment. The attack vector demonstrates that even seemingly benign features like password caching can become security liabilities when proper cryptographic controls are not implemented. Organizations that failed to address this vulnerability would have been exposed to credential theft attacks that could lead to unauthorized access to network resources and potential data breaches. The vulnerability also underscores the importance of regular security assessments and the need for robust access controls to prevent unauthorized local access to sensitive system files.