# CVE-1999-0016: Multiple Vendors TCP/IP Land denial of service

Source: https://junglewise.ai/threats/cve-1999-0016-multiple-vendors-tcp-ip-land-denial-of-service  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 1997-12-01. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-1999-0016 · Severity: medium · CVSS 5 · Published 1997-12-01

A classic networking vulnerability, known as a 'Land' attack, affects various operating systems and networking devices. An attacker can send a specially crafted network packet that causes a system to attempt to communicate with itself, leading to a crash or severe performance slowdown. This results in a denial of service, preventing legitimate users from accessing the affected system or its services.

Technologies: [Hp-Ux](https://junglewise.ai/threats/technologies/hp-ux). Vendors: [Hp](https://junglewise.ai/threats/vendors/hp), [NetApp](https://junglewise.ai/threats/vendors/netapp).

## Quick answers

**Is CVE-1999-0016 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-1999-0016 being exploited in the wild.

**How severe is CVE-1999-0016?** Medium severity, with a CVSS score of 5, published 1 December 1997.

**Which products and versions are affected?** HP HP-UX; NetApp ONTAP.

**Is there a fix for CVE-1999-0016?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-1999-0016 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-1999-0016?** Check whether you run Hp-Ux or NetApp ONTAP. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The 'Land' attack is a classic denial of service (DoS) vulnerability involving the transmission of a spoofed TCP SYN packet where the source IP address and port are set to be identical to the destination IP address and port. When a vulnerable TCP/IP stack receives such a packet, it may enter an infinite loop or crash while attempting to respond to itself. This is a remote, unauthenticated attack vector. While modern operating systems have long since patched this issue, it historically affected a wide range of platforms including HP-UX and various networking appliances. Mitigation typically involves ingress filtering to drop packets with internal source addresses arriving from external interfaces.

## Affected products

- HP HP-UX
- NetApp ONTAP

## Timeline

- 1997-12-01: disclosed: Initial publication date
- 2017-08-15: advisory: NetApp advisory published

## References

- [http://www1.itrc.hp.com/service/cki/docDisplay.do?docId=HPSBUX9801-076](http://www1.itrc.hp.com/service/cki/docDisplay.do?docId=HPSBUX9801-076)
- [https://security.netapp.com/advisory/ntap-20170815-0001/](https://security.netapp.com/advisory/ntap-20170815-0001/)

## Related threats

- [IBM Informix Dynamic Server 14.10, 15.0, and 12.10 could allow an unauthenticated user to execute arbitrary commands…](https://junglewise.ai/threats/cve-2026-13476-ibm-informix-dynamic-server-14-10-15-0-and-12-10-could-allow-an)
- [IBM Informix Dynamic Server 14.10, and 15.0 contain a local privilege escalation vulnerability in the oninit setuid-root utility.](https://junglewise.ai/threats/cve-2026-13367-ibm-informix-dynamic-server-14-10-and-15-0-contain-a-local)
- [Sun Solaris automountd command injection via shell metacharacters](https://junglewise.ai/threats/cve-1999-0210-sun-solaris-automountd-command-injection-via-shell-metacharacters)
- [Linux inetd denial of service via SYN and RST packets](https://junglewise.ai/threats/cve-1999-0216-linux-inetd-denial-of-service-via-syn-and-rst-packets)
- [HP HP-UX denial of service in telnet service](https://junglewise.ai/threats/cve-1999-1213-hp-hp-ux-denial-of-service-in-telnet-service)