CVE-1999-0875: High severity Microsoft Windows 2000 vulnerability
DHCP clients with ICMP Router Discovery Protocol (IRDP) enabled allow remote attackers to modify their default routes.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable IRDP on affected Windows DHCP clients so they do not accept ICMP router discovery/advertisement messages that can change the default route.
DHCP client (Microsoft Windows 2000, Windows 98, Windows 9x) ICMP Router Discovery Protocol (IRDP) enabled = disabled - Configuration
Disable IRDP on affected Solaris/SunOS DHCP clients so they do not accept ICMP router discovery/advertisement messages that can change the default route.
DHCP client (Oracle Solaris, SunOS, Oracle Solaris with ZFS) ICMP Router Discovery Protocol (IRDP) enabled = disabled - Compensating control
Block or filter ICMP router discovery/advertisement messages at network boundaries and between untrusted networks and client subnets (e.g., via firewall rules or ACLs) to prevent remote hosts from sending router advertisements that alter client default routes.
- Operational
Audit clients to determine which systems have IRDP enabled, verify their default route configurations, and restore correct routes where unauthorized changes are found; investigate any suspected unauthorized route modifications.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-0875?
CVE-1999-0875 is considered a medium severity vulnerability as it allows remote attackers to alter default routing configurations.
How do I fix CVE-1999-0875?
To fix CVE-1999-0875, disable the ICMP Router Discovery Protocol (IRDP) feature on affected systems.
Which operating systems are affected by CVE-1999-0875?
CVE-1999-0875 affects Microsoft Windows 95, Windows 98SE, Windows 2000, and Sun SunOS systems.
Can CVE-1999-0875 lead to further attacks?
Yes, CVE-1999-0875 can facilitate man-in-the-middle attacks by allowing attackers to manipulate routing.
Is there a patch for CVE-1999-0875?
There is no specific patch for CVE-1999-0875, but disabling IRDP mitigates the vulnerability.