CVE-1999-1339: Medium severity FreeBSD FreeBSD vulnerability
Vulnerability when Network Address Translation (NAT) is enabled in Linux 2.2.10 and earlier with ipchains, or FreeBSD 3.2 with ipfw, allows remote attackers to cause a denial of service (kernel panic) via a ping -R (record route) command.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
ipchains (Linux)from your environment.Uninstall ipchains from systems where it is not required to eliminate the vulnerable NAT handling.
- Remove
Remove
ipfw (FreeBSD)from your environment.Uninstall ipfw from systems where it is not required to eliminate the vulnerable NAT handling.
- Configuration
Disable NAT in ipchains (turn off ipchains NAT functionality) to prevent the ping -R (record route) input case that can cause a kernel panic.
Linux (ipchains) NAT enabled = false - Configuration
Disable NAT in ipfw (turn off ipfw NAT functionality) to prevent the ping -R (record route) input case that can cause a kernel panic.
FreeBSD (ipfw) NAT enabled = false - Compensating control
At the network perimeter or upstream routers/firewalls, block or filter ICMP echo requests that include the record-route option (ping -R) to prevent remote attackers from triggering the vulnerability.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-1339?
CVE-1999-1339 is considered a moderate severity vulnerability due to its potential to cause a denial of service.
How do I fix CVE-1999-1339?
To mitigate CVE-1999-1339, upgrade to Linux Kernel versions later than 2.2.10 or FreeBSD versions later than 3.2.
What systems are affected by CVE-1999-1339?
CVE-1999-1339 affects Linux Kernel versions up to 2.2.10 and FreeBSD 3.2.
What type of attack does CVE-1999-1339 facilitate?
CVE-1999-1339 facilitates a denial of service attack that can result in a kernel panic.
Is CVE-1999-1339 still a relevant vulnerability?
While it is an older vulnerability, CVE-1999-1339 remains relevant for systems still running affected versions of the software.