CVE-1999-0899

Vulnerability

The Windows NT 4.0 print spooler contains a privilege escalation vulnerability (CVE-1999-0899) due to incorrect permissions that allow a local user to specify an alternate print provider [1]. Print providers run in the local System context. Affected versions include Windows NT 4.0 Workstation, Server, Enterprise Edition, and Terminal Server Edition [1].

Exploitation

An attacker must have a local user account on the target system; no special group membership is required [1]. The attacker can specify their own code as a print provider, which the spooler will load and execute. This vulnerability cannot be exploited remotely [1].

Impact

Successful exploitation allows the attacker to execute arbitrary code in the context of the local System account, thereby gaining full control of the affected machine [1].

Mitigation

Microsoft released a patch in Security Bulletin MS99-047 to address this vulnerability [1]. The patch is available for all affected Windows NT 4.0 editions. No workarounds are documented in the bulletin. This CVE is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog.