CVE-1999-1105 in Windows
Summary
by MITRE
Windows 95, when Remote Administration and File Sharing for NetWare Networks is enabled, creates a share (C$) when an administrator logs in remotely, which allows remote attackers to read arbitrary files by mapping the network drive.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 04/20/2026
This vulnerability exists in Windows 95 systems that have Remote Administration and File Sharing for NetWare Networks component enabled. The flaw manifests when an administrator logs in remotely to the system, as the operating system automatically creates a hidden administrative share named C$ that maps to the local system drive. This share is accessible to remote users without proper authentication mechanisms, creating a significant security risk that has been classified under CWE-264. The vulnerability represents a classic privilege escalation issue where legitimate administrative functionality is exploited to provide unauthorized access to system resources.
The technical implementation of this flaw stems from the default configuration of Windows 95's file sharing services. When Remote Administration is enabled, the system automatically establishes the C$ share regardless of user permissions or security settings. This share allows remote attackers to map network drives to the local system drive and read arbitrary files without proper authentication. The vulnerability operates at the network level and leverages the inherent trust relationships within the Windows file sharing protocol, making it particularly dangerous as it bypasses normal access controls. The attack vector is straightforward and requires minimal technical expertise to exploit, making it a preferred target for malicious actors.
The operational impact of this vulnerability is severe as it provides attackers with unrestricted access to sensitive system files, configuration data, and potentially user information stored on the local drive. Remote attackers can enumerate and extract critical system components, including registry files, system binaries, and user data, leading to complete system compromise. This vulnerability directly maps to ATT&CK technique T1077 which involves exploiting remote services to gain access to systems. The exposure of the C$ share creates a persistent backdoor that can be exploited repeatedly, allowing attackers to maintain long-term access to compromised systems while remaining undetected by standard security monitoring.
Mitigation strategies should focus on disabling unnecessary network services and implementing proper access controls. The primary defense involves turning off the Remote Administration and File Sharing for NetWare Networks component when not required, which eliminates the automatic creation of the C$ share. Network administrators should also implement proper firewall rules to restrict access to Windows file sharing ports, particularly TCP ports 139 and 445. Additionally, the system should be configured to disable automatic share creation and enforce strong authentication mechanisms for all network access. Regular security audits should verify that no unauthorized shares exist, and network monitoring should detect suspicious share access attempts. The vulnerability underscores the importance of principle of least privilege and proper system hardening practices that align with security frameworks such as the NIST Cybersecurity Framework and CIS Controls.