CVE-1999-1254: Medium severity Microsoft Windows NT vulnerability
Windows 95, 98, and NT 4.0 allow remote attackers to cause a denial of service by spoofing ICMP redirect messages from a router, which causes Windows to change its routing tables.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Configure the Windows TCP/IP settings to ignore or not install ICMP Redirect (Type 5) messages so hosts do not change routing tables when receiving redirected packets.
Microsoft Windows 95/98 and NT TCP/IP stack accept ICMP redirect messages = disabled - Compensating control
Block or filter ICMP Redirect (Type 5) messages at network perimeter devices (firewalls/routers) so spoofed redirects from untrusted networks cannot reach Windows hosts.
- Operational
After applying the above controls, inspect and, if necessary, restore correct routing table entries on affected Windows hosts to recover from any spoofed-redirect-induced changes.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-1254?
CVE-1999-1254 has a medium severity rating due to its capability to cause a denial of service.
How do I fix CVE-1999-1254?
To fix CVE-1999-1254, consider disabling ICMP redirect messages on the affected systems.
Which versions of Windows are affected by CVE-1999-1254?
CVE-1999-1254 affects Windows 95, Windows 98, and Windows NT 4.0.
What type of attack does CVE-1999-1254 enable?
CVE-1999-1254 enables a denial of service attack through spoofed ICMP redirect messages.
Can CVE-1999-1254 be exploited remotely?
Yes, CVE-1999-1254 can be exploited remotely by attackers spoofing ICMP messages.