CVE-1999-1423: Low severity Sun SunOS vulnerability
ping in Solaris 2.3 through 2.6 allows local users to cause a denial of service (crash) via a ping request to a multicast address through the loopback interface, e.g. via ping -i.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Restrict execution of the ping binary so that only privileged users can run it (for example, remove execute permissions or remove the setuid bit for non-privileged users) to prevent local users from invoking ping -i to multicast addresses via the loopback interface.
ping (Solaris) execution permission = restricted to privileged users - Compensating control
Block or filter multicast traffic on the loopback interface (and/or apply local firewall rules) to prevent ping requests to multicast addresses over lo, thereby mitigating the ability of local users to trigger the crash.
- Operational
Avoid running ping -i to multicast addresses via the loopback interface on affected Solaris/SunOS systems until a vendor fix is available; monitor systems for crashes and apply normal recovery procedures if a denial-of-service occurs.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-1423?
CVE-1999-1423 is considered a denial of service vulnerability that can cause system crashes.
How can CVE-1999-1423 affect systems using Solaris?
CVE-1999-1423 allows local users to crash the system by sending ping requests to a multicast address via the loopback interface.
Which versions of Solaris are vulnerable to CVE-1999-1423?
CVE-1999-1423 affects Solaris versions 2.3 through 2.6, including specific builds of SunOS.
How do I mitigate CVE-1999-1423?
To mitigate CVE-1999-1423, restrict access to the ping command or filter multicast ping requests on the loopback interface.
Is there a patch available for CVE-1999-1423?
There are no widely recognized patches available for CVE-1999-1423, so implementing network security best practices is crucial.