• CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
The Microsoft Jet database engine allows an attacker to execute commands via a database query, aka the "VBA Shell" vulnerability.
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
Assigning CNA
MITRE Corporation
Date Record Created
20000511 Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Modified (20020222)
Votes (Legacy)
ACCEPT(5) Armstrong, Baker, Cole, Prosser, Wall
MODIFY(1) Frech
REJECT(1) LeBlanc
REVIEWING(1) Christey
Comments (Legacy)
 LeBlanc> - same as CVE-1999-1011
   If I'm misunderstanding something here, please correct me.  In fact, it has
   the same bulletin as a reference.
 Frech> XF:jet-vba-shell
 Prosser> This entry is not the same as "now" CVE-1999-1011. That entry is "The Remote Data Service (RDS) DataFactory component of Microsoft Data Access Components (MDAC) in IIS 3.x and 4.x exposes unsafe methods, which allows remote attackers to execute arbitrary commands."  This one should be correct.
 Christey> BUGTRAQ:19990525 Advisory: NT ODBC Remote Compromise
   NTBUGTRAQ:19990526 Advisory: NT ODBC Remote Compromise
 Christey> The Microsoft advisory itself describes two separate
   vulnerabilities, calling the TEXT I-ISAM problem
   (CVE-2000-0323) a variant of the VBA Shell problem (this
   CAN).  In addition, CVE-2000-0323 does *not* appear in Jet
   4.0, while this one does.  Since one problem appears in a
   different version than the other, CD:SF-LOC suggests keeping
   these candidates SPLIT.
 CHANGE> [Christey changed vote from NOOP to REVIEWING]
 Christey> Need to clarify whether the Bugtraq/NTBugtraq posts are
   really describing the same issue (those are BID:286).

Proposed (Legacy)
This is a record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.