Is CVE-1999-0305 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-1999-0305 being exploited in the wild.

How severe is CVE-1999-0305?

Medium severity, with a CVSS score of 5, published 1 February 1998.

Which products and versions are affected?

OpenBSD Project OpenBSD 2.2 and earlier; FreeBSD Project FreeBSD 2.2.5 and earlier.

Is there a fix for CVE-1999-0305?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-1999-0305 attacked?

It is attacked over the network, in an operating system.

Am I affected by CVE-1999-0305?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-1999-0305: BSD sysctl improper restriction of source routed packets

CVE-1999-0305 · Severity: medium · CVSS 5 · Published 1998-02-01

A vulnerability in the networking component of BSD-based operating systems allows remote attackers to bypass security controls and impersonate trusted connections. By exploiting how the system handles specifically routed network traffic, an attacker can trick the system into accepting unauthorized data or bypassing firewall-like restrictions. This could lead to unauthorized access to services or the ability to intercept sensitive communications.

Quick answers

Is CVE-1999-0305 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-1999-0305 being exploited in the wild.
How severe is CVE-1999-0305?: Medium severity, with a CVSS score of 5, published 1 February 1998.
Which products and versions are affected?: OpenBSD Project OpenBSD 2.2 and earlier; FreeBSD Project FreeBSD 2.2.5 and earlier.
Is there a fix for CVE-1999-0305?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-1999-0305 attacked?: It is attacked over the network, in an operating system.
Am I affected by CVE-1999-0305?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists within the kernel function 'ip_dooptions()' in 4.4BSD-based kernels. The 'dosourceroute' sysctl variable was incorrectly implemented, only preventing the forwarding of source-routed packets rather than their local delivery. Additionally, the 'forwarding' variable was not checked within the source-routing logic, allowing packets to be forwarded even when global IP forwarding was disabled. An attacker can use IP source routing to direct TCP responses back to their own machine, allowing them to predict sequence numbers and complete a three-way handshake to spoof a connection from a trusted IP address. Patches were released for OpenBSD and FreeBSD to enforce these checks at the start of packet processing.

Affected products

OpenBSD Project OpenBSD 2.2 and earlier
FreeBSD Project FreeBSD 2.2.5 and earlier

Timeline

1998-02-01: advisory: NVD Published Date
1998-02-15: disclosed: OpenBSD Security Advisory released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.