Microsoft Windows 95/98/ME/NT File System FAT privileges management

Summaryinfo

A vulnerability described as critical has been identified in Microsoft Windows 95/98/ME/NT. The impacted element is an unknown function of the component File System. Executing a manipulation as part of FAT can lead to privileges management. This vulnerability is tracked as CVE-1999-0584. Moreover, an exploit is present. Modifying the configuration settings is advised.

Detailsinfo

A vulnerability was found in Microsoft Windows 95/98/ME/NT (Operating System). It has been declared as very critical. This vulnerability affects an unknown code block of the component File System. The manipulation as part of a FAT leads to a privileges management vulnerability. The CWE definition for the vulnerability is CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

A Windows NT file system is not NTFS.

The issue has been introduced in 08/24/1995. The weakness was disclosed 01/01/1999. This vulnerability was named CVE-1999-0584. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Technical details are unknown but a public exploit is available. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 04/18/2026). This vulnerability is assigned to T1068 by the MITRE ATT&CK project.

It is declared as highly functional. The vulnerability was handled as a non-public zero-day exploit for at least 1226 days. During that time the estimated underground price was around $25k-$100k.

It is possible to mitigate the problem by applying the configuration setting .

The vulnerability is also documented in the databases at X-Force (195) and Vulnerability Center (SBV-668†). The entries VDB-14366, VDB-14361, VDB-14360 and VDB-14359 are pretty similar. If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Operating System

Vendor

• Microsoft

Name

• Windows

Version

• 95
• 98
• ME
• NT

License

• commercial

Website

• Vendor: https://www.microsoft.com/
• Product: https://www.microsoft.com/en-us/windows

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion