medium4.6Public exploit code
CVE-1999-1431
ZAK in Appstation mode allows users to bypass the "Run only allowed apps" policy by starting Explorer from Office 97 applications (such as Word), installing so…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Microsoft Zero Administration Kit (ZAK) 1.0 / Office97 - Backdoor Access1999-01-07 · local · windows · Verified
Impact
ZAK in Appstation mode allows users to bypass the "Run only allowed apps" policy by starting Explorer from Office 97 applications (such as Word), installing software into the TEMP directory, and changing the name to that for an allowed application, such as Winword.exe.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Microsoft | Zero Administration Kit | Version 1.0 |