CVE-1999-0764: Medium severity netbsd netbsd vulnerability
NetBSD allows ARP packets to overwrite static ARP entries.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Enable network-level ARP protections to prevent unauthorized ARP updates from reaching NetBSD hosts. Examples: enable Dynamic ARP Inspection (DAI) or equivalent on switches, enable port security and DHCP snooping, and filter/validate ARP on upstream devices.
- Compensating control
Restrict ARP traffic to trusted sources and isolate vulnerable hosts: place systems that rely on static ARP entries in separated VLANs or networks and apply firewall/ACL rules so only trusted management hosts can send ARP traffic to those systems.
- Operational
Audit and monitor static ARP entries on NetBSD hosts: record current static ARP mappings, detect and alert on any unexpected overwrites, re-apply verified static entries when appropriate, and investigate incidents where static entries were overwritten.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-0764?
The severity of CVE-1999-0764 is classified as high due to its ability to overwrite static ARP entries.
How do I fix CVE-1999-0764?
To fix CVE-1999-0764, it is recommended to update to a version of NetBSD that does not allow ARP packets to overwrite static ARP entries.
Which versions of NetBSD are affected by CVE-1999-0764?
CVE-1999-0764 affects NetBSD version 1.3.
What type of vulnerability is CVE-1999-0764?
CVE-1999-0764 is a vulnerability related to the Address Resolution Protocol (ARP) allowing packet manipulation.
Can CVE-1999-0764 lead to network security issues?
Yes, CVE-1999-0764 can lead to serious network security issues such as ARP spoofing and man-in-the-middle attacks.