CVE-1999-1201: Medium severity Microsoft Windows 95 vulnerability
Windows 95 and Windows 98 systems, when configured with multiple TCP/IP stacks bound to the same MAC address, allow remote attackers to cause a denial of service (traffic amplification) via a certain ICMP echo (ping) packet, which causes all stacks to send a ping response, aka TCP Chorusing.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Ensure systems are not configured with multiple TCP/IP stacks bound to the same MAC address. Unbind duplicate TCP/IP stacks or assign unique MAC addresses so that only one stack is bound per MAC address.
TCP/IP configuration on Microsoft Windows 95/98 multiple TCP/IP stacks bound to the same MAC address = disabled - Compensating control
Block or rate-limit ICMP echo (ping) packets at the network perimeter or on intermediate routers to reduce the risk of remote-triggered traffic amplification until systems are reconfigured.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-1201?
CVE-1999-1201 is considered a denial of service vulnerability that can impact systems running Windows 95 and Windows 98.
How do I fix CVE-1999-1201?
To mitigate CVE-1999-1201, reconfigure the TCP/IP settings to prevent multiple stacks from binding to the same MAC address.
What types of systems are affected by CVE-1999-1201?
CVE-1999-1201 affects Microsoft Windows 95 and Windows 98 systems configured with multiple TCP/IP stacks.
What attack does CVE-1999-1201 exploit?
CVE-1999-1201 exploits the systems by causing traffic amplification through a specific ICMP echo packet.
What is TCP Chorusing in the context of CVE-1999-1201?
TCP Chorusing refers to the denial of service condition where multiple TCP/IP stacks respond to a single ICMP ping request.