The Remote Data Service (RDS) DataFactory component of Microsoft Data Access Components (MDAC) in IIS 3.x and 4.x exposes unsafe methods, w…

Exploit prediction (EPSS)

77.14% probability of exploitation in the next 30 days, higher than 100% of all scored CVEs.

Exploits and detections

• Metasploit exploit/windows/iis/msadc MS99-025 Microsoft IIS MDAC msadcs.dll RDS Arbitrary Remote Command Execution · metasploit exploit, excellent rank · 1998-07-17
• EDB-19425 Microsoft Data Access Components (MDAC) 2.1 / Microsoft IIS 3.0/4.0 / Microsoft Index Server 2.0 / Microsoft Site Server Commerce Edition 3.0 i386 MDAC - RDS (2) · local · 1999-07-19
• EDB-19424 Microsoft Data Access Components (MDAC) 2.1 / Microsoft IIS 3.0/4.0 / Microsoft Index Server 2.0 / Microsoft Site Server Commerce Edition 3.0 i386 MDAC - RDS (1) · remote · 1999-07-19

CVSS scores

Classification

Weakness

• CWE-264 Permissions, Privileges, and Access Controls

References

• docs.microsoft.com /en-us/security-updates/securitybulletins/1999/ms99-025 · vendor-advisory, x_refsource_MS, x_transferred
• securityfocus.com /bid/529 · vdb-entry, x_refsource_BID, x_transferred
• osvdb.org /272 · vdb-entry, x_refsource_OSVDB, x_transferred
• ciac.org /ciac/bulletins/j-054.shtml · third-party-advisory, government-resource, x_refsource_CIAC, x_transferred
• docs.microsoft.com /en-us/security-updates/securitybulletins/1998/ms98-004 · vendor-advisory, x_refsource_MS, x_transferred

Sources

• CVE List: CVE-1999-1011
• NVD: CVE-1999-1011

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.