# CVE-1999-0799: bootpd buffer overflow via long boot file location

Source: https://junglewise.ai/threats/cve-1999-0799-bootpd-buffer-overflow-via-long-boot-file-location  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 1997-06-01. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-1999-0799 · Severity: critical · CVSS 10 · Published 1997-06-01

A critical vulnerability exists in bootpd, a service used to provide configuration and boot information to computers on a network. By sending a specially crafted request with an excessively long file path, an attacker can take complete control of the server. This could lead to a total system compromise, data theft, or the disruption of network booting services.

Vendors: [Cmu](https://junglewise.ai/threats/vendors/cmu).

## Quick answers

**Is CVE-1999-0799 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-1999-0799 being exploited in the wild.

**How severe is CVE-1999-0799?** Critical severity, with a CVSS score of 10, published 1 June 1997.

**Which products and versions are affected?** bootpd 2.4.3 and earlier.

**Is there a fix for CVE-1999-0799?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-1999-0799 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-1999-0799?** Check whether you run Cmu Bootpd. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A classic stack-based buffer overflow exists in the bootpd daemon (versions 2.4.3 and prior) during the handling of boot file location strings. The vulnerability is triggered when the service processes a BOOTP request containing an overly long path for the boot file, which exceeds the allocated buffer size without proper bounds checking. This is a remote, unauthenticated attack vector. Successful exploitation allows an attacker to overwrite the instruction pointer and execute arbitrary code with the privileges of the bootpd process, typically root. Organizations should update to a patched version or migrate to modern DHCP implementations.

## Affected products

- bootpd 2.4.3 and earlier

## Timeline

- 1997-06-01: disclosed: Initial publication date in NVD

## References

- [https://exchange.xforce.ibmcloud.com/vulnerabilities/CVE-1999-0799](https://exchange.xforce.ibmcloud.com/vulnerabilities/CVE-1999-0799)