CVE-1999-1011

HighPublished

The Remote Data Service (RDS) DataFactory component of Microsoft Data Access Components (MDAC) in IIS 3.x and 4.x exposes unsafe methods, which allows...

Published: Jun 2, 2000
Updated: Aug 1, 2024
Assigning CNA: mitre
Evidence observed: Jul 19, 1999

Primary CVSS

10.0/ 10High

nvd · CVSS 2.0

AV:N/AC:L/Au:N/C:C/I:C/A:C

EPSS probability estimate

77.1%

High · next 30 days

Percentile: 99.5%
Model date: Oct 14, 2026

EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.

Summary

The Remote Data Service (RDS) DataFactory component of Microsoft Data Access Components (MDAC) in IIS 3.x and 4.x exposes unsafe methods, which allows remote attackers to execute arbitrary commands.

Sources

Repository evidence: Files: 1 · Repositories: 1

1 Module

MS99-025 Microsoft IIS MDAC msadcs.dll RDS Arbitrary Remote Command ExecutionModule
modules/exploits/windows/iis/msadc.rb
Metasploit Framework modules
ExploitEvidence observed: Sep 26, 2026Revision: be32cd78a532Related tool
Declared conditions
- platform: Windows($.exploit_windows/iis/msadc.platform)
- verification: check_declared($.exploit_windows/iis/msadc.check)

Microsoft Data Access Components (MDAC) 2.1 / Microsoft IIS 3.0/4.0 / Microsoft Index Server 2.0 / Microsoft Site Server Commerce Edition 3.0 i386 MDAC - RDS (1)Exploit
rain forest puppy · windows · Jul 19, 1999

Responsible use

Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.