CVE-1999-0116: Medium severity IBM AIX vulnerability
Denial of service when an attacker sends many SYN packets to create multiple connections without ever sending an ACK to complete the connection, aka SYN flood.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Enable SYN cookie protection on affected hosts and network devices to reduce impact of SYN-floods (turn on OS or device support for SYN cookies).
TCP/IP stack SYN cookies = enabled - Configuration
Configure the firewall or load balancer to rate-limit or throttle incoming SYN packets and limit incomplete connection queues per source IP to mitigate SYN flood traffic.
Network edge (firewall/load balancer) SYN rate limiting / connection throttling = enabled - Configuration
Adjust the TCP/IP backlog size and reduce the timeout for incomplete (half-open) connections to limit resource exhaustion from many unacknowledged SYNs.
TCP/IP stack SYN backlog / half-open connection timeout = tuned - Compensating control
Use upstream DDoS/SYN-flood mitigation services (scrubbing, CDN, or ISP filtering) and apply network-edge filtering to block or absorb large SYN floods before they reach affected hosts.
- Operational
Monitor for spikes in SYN packets and incomplete connections, create alerts and incident response playbooks, and clear or restart network stacks/services as needed during an active SYN flood.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-0116?
CVE-1999-0116 has a high severity rating as it can lead to denial of service.
How do I fix CVE-1999-0116?
To address CVE-1999-0116, implement SYN flood protection features available in your network hardware or operating system.
Which systems are affected by CVE-1999-0116?
CVE-1999-0116 affects IBM AIX versions 3.2.5, 4.1, and 4.2, as well as IBM Sng versions 2.1 and 2.2.
What is a SYN flood attack related to CVE-1999-0116?
A SYN flood attack, related to CVE-1999-0116, is when an attacker sends a large number of SYN packets to overwhelm a system without completing the connection.
What are the potential impacts of CVE-1999-0116?
The potential impacts of CVE-1999-0116 include service unavailability and decreased performance due to resource exhaustion.