CVE-1999-0524: Infoleak
ICMP information such as (1) netmask and (2) timestamp is allowed from arbitrary hosts.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable ICMP timestamp and ICMP address-mask (netmask) reply functionality on each affected system (e.g., Apple iOS/macOS, Cisco IOS, Linux kernel, Windows, Solaris, AIX, HP-UX, etc.) so hosts do not return timestamp or netmask information to arbitrary remote hosts. Follow vendor-specific configuration steps to turn off these ICMP responses.
ICMP implementation on affected systems timestamp and netmask (address-mask) replies = disabled - Compensating control
Block or filter incoming ICMP timestamp and ICMP address-mask request messages from untrusted networks at perimeter devices (firewalls, routers, and edge filtering) to prevent arbitrary hosts from obtaining netmask and timestamp information.
- Operational
Scan and audit network hosts to identify systems that respond to ICMP timestamp or address-mask requests, remediate those hosts by applying the configuration change, and verify that responses are no longer returned to arbitrary hosts.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-0524?
CVE-1999-0524 is considered a low severity vulnerability that allows information disclosure through ICMP messages.
How do I fix CVE-1999-0524?
To fix CVE-1999-0524, ensure that access controls are implemented to restrict ICMP queries from arbitrary hosts.
What impact does CVE-1999-0524 have on affected software?
CVE-1999-0524 may expose sensitive network configuration information such as netmask and timestamp to unauthorized hosts.
Is CVE-1999-0524 exploitable in current environments?
While CVE-1999-0524 is an older vulnerability, it may still be exploitable depending on the network configuration and implemented security measures.
Which systems are affected by CVE-1999-0524?
CVE-1999-0524 affects various systems including Apple macOS, Cisco IOS, HPE HP-UX, IBM AIX, Linux Kernel, Microsoft Windows, and others.