Is CVE-1999-0016 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-1999-0016 being exploited in the wild.

How severe is CVE-1999-0016?

Medium severity, with a CVSS score of 5, published 1 December 1997.

Is there a fix for CVE-1999-0016?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-1999-0016 attacked?

It is attacked over the network, in an operating system.

Am I affected by CVE-1999-0016?

Check whether you run Hp-Ux or NetApp ONTAP. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-1999-0016: Multiple Vendors TCP/IP Land denial of service

CVE-1999-0016 · Severity: medium · CVSS 5 · Published 1997-12-01

A classic networking vulnerability, known as a 'Land' attack, affects various operating systems and networking devices. An attacker can send a specially crafted network packet that causes a system to attempt to communicate with itself, leading to a crash or severe performance slowdown. This results in a denial of service, preventing legitimate users from accessing the affected system or its services.

Technologies: Hp-Ux. Vendors: Hp, NetApp.

Quick answers

Is CVE-1999-0016 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-1999-0016 being exploited in the wild.
How severe is CVE-1999-0016?: Medium severity, with a CVSS score of 5, published 1 December 1997.
Which products and versions are affected?: HP HP-UX; NetApp ONTAP.
Is there a fix for CVE-1999-0016?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-1999-0016 attacked?: It is attacked over the network, in an operating system.
Am I affected by CVE-1999-0016?: Check whether you run Hp-Ux or NetApp ONTAP. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The 'Land' attack is a classic denial of service (DoS) vulnerability involving the transmission of a spoofed TCP SYN packet where the source IP address and port are set to be identical to the destination IP address and port. When a vulnerable TCP/IP stack receives such a packet, it may enter an infinite loop or crash while attempting to respond to itself. This is a remote, unauthenticated attack vector. While modern operating systems have long since patched this issue, it historically affected a wide range of platforms including HP-UX and various networking appliances. Mitigation typically involves ingress filtering to drop packets with internal source addresses arriving from external interfaces.

Affected products

HP HP-UX
NetApp ONTAP

Timeline

1997-12-01: disclosed: Initial publication date
2017-08-15: advisory: NetApp advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.