CVE-1999-1132: Medium severity Microsoft Windows NT vulnerability
Windows NT 4.0 allows remote attackers to cause a denial of service (crash) via extra source routing data such as (1) a Routing Information Field (RIF) field with a hop count greater than 7, or (2) a list containing duplicate Token Ring IDs.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable acceptance/processing of IP source-routed packets on Windows NT hosts to prevent crashes caused by malicious Routing Information Field (RIF) values (e.g., hop count > 7).
Windows NT network stack accept_source_routed_packets = disable - Configuration
Disable Token Ring network interfaces or Token Ring support on Windows NT hosts if not required to avoid processing lists containing duplicate Token Ring IDs.
Token Ring interfaces enabled = false - Compensating control
Block or drop source-routed packets at the network edge and on internal routers/firewalls; implement filters to drop packets with RIF hop counts greater than expected (e.g., >7) or packets exhibiting duplicate Token Ring IDs before they reach Windows NT systems. Restrict network access to Windows NT hosts to trusted networks only.
- Operational
If a Windows NT host has crashed, isolate it from the network and reboot to recover. Enable logging/monitoring to detect incoming packets with source-routing fields (RIF) and investigate for attempted exploitation.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-1132?
CVE-1999-1132 is considered a high severity vulnerability due to its potential to cause a denial of service on affected systems.
How do I fix CVE-1999-1132?
To fix CVE-1999-1132, update to a version of Windows that is not susceptible to this vulnerability or implement network filtering to block malicious traffic.
What types of attacks exploit CVE-1999-1132?
CVE-1999-1132 can be exploited by attackers sending specially crafted packets with excessive source routing data.
Which systems are affected by CVE-1999-1132?
CVE-1999-1132 specifically affects Microsoft Windows NT version 4.0.
What is the impact of CVE-1999-1132 on my network?
The impact of CVE-1999-1132 is a potential crash of Windows NT 4.0 systems, leading to downtime and service interruption.