CVE-1999-0396: Race Condition
A race condition between the select() and accept() calls in NetBSD TCP servers allows remote attackers to cause a denial of service.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Stop or temporarily disable affected TCP server services (or configure them to refuse/stop accepting new connections) on NetBSD hosts until a vendor fix is available to avoid the select()/accept() race causing a DoS.
NetBSD TCP servers accepting new TCP connections = disabled - Configuration
Stop or temporarily disable TCP server services (or configure them to refuse/stop accepting new connections) on OpenBSD hosts until a vendor fix or advisory is available, to avoid exposure to the described DoS condition.
OpenBSD TCP servers accepting new TCP connections = disabled - Compensating control
Restrict network access to vulnerable TCP services using firewall rules, ACLs, or network segmentation—allow only trusted IPs to connect to affected hosts or block untrusted traffic to TCP service ports until a patch is available.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-0396?
CVE-1999-0396 is classified as a medium severity vulnerability due to its potential to cause a denial of service.
How do I fix CVE-1999-0396?
To fix CVE-1999-0396, it is recommended to update your NetBSD or OpenBSD system to a version that addresses this race condition.
Which versions are affected by CVE-1999-0396?
CVE-1999-0396 affects NetBSD versions prior to 2.0.4 and OpenBSD version 2.4.
What type of attack is associated with CVE-1999-0396?
CVE-1999-0396 allows remote attackers to exploit a race condition to achieve denial of service conditions.
Is CVE-1999-0396 specific to certain operating systems?
Yes, CVE-1999-0396 specifically affects NetBSD and OpenBSD TCP servers.