CVE-1999-0513
published 1998-01-05CVE-1999-0513: ICMP messages to broadcast addresses are allowed, allowing for a Smurf attack that can cause a denial of service.
PriorityP429medium5CVSS 2.0
AVNACLAuNCNINAP
EXPLOIT
EPSS
70.93%
99.4th percentile
ICMP messages to broadcast addresses are allowed, allowing for a Smurf attack that can cause a denial of service.
Affected
31 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| digital | unix | — | — |
| digital | unix | — | — |
| digital | unix | — | — |
| digital | unix | — | — |
| digital | unix | — | — |
| digital | unix | — | — |
| freebsd | freebsd | — | — |
| freebsd | freebsd | — | — |
| freebsd | freebsd | — | — |
| freebsd | freebsd | — | — |
| freebsd | freebsd | — | — |
| freebsd | freebsd | — | — |
| freebsd | freebsd | — | — |
| freebsd | freebsd | — | — |
| freebsd | freebsd | — | — |
| hp | hp-ux | — | — |
| hp | hp-ux | — | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| netbsd | netbsd | — | — |
| sun | solaris | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect spoofed ICMP echo requests (type 8, code 0) destined for IP broadcast addresses — hallmark of Smurf attack traffic generation. ↗
- →Alert on high-volume ICMP echo replies directed at a single host from many different sources — indicative of amplified Smurf reflection traffic hitting the victim. ↗
- →The exploit reads broadcast addresses from a flat file ('bcast file') at runtime; presence of smurf.c or associated broadcast-list files on a host is a host-based indicator. ↗
- →Raw socket usage with IP_HDRINCL and manually crafted IP headers (TTL=255, protocol=ICMP, spoofed saddr) should be flagged by host-based process monitoring. ↗
- ·The vulnerability only exists on networks/hosts that forward or respond to ICMP packets sent to IP broadcast addresses; hosts/routers configured to drop such packets are not exploitable. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No writeups or analysis indexed.
CWE
Asymmetric Resource Consumption (Amplification)
mitre_cwe
CWE-405 Asymmetric Resource Consumption (Amplification)
CWE-405: Asymmetric Resource Consumption (Amplification)
The product does not properly control situations in which an adversary can cause the product to consume or produce excessive resources without requiring the adversary to invest equivalent work or otherwise prove authorization, i.e., the adversary's influence is "asymmetric."
This can lead to poor performance due to "amplification" of resource consumption, typically in a non-linear fashion. This situation is worsened if the product allows malicious users or attackers to consume more resources than their access level permits.
Modes of Introduction:
Phase: Architecture and Design
Phase: Implementation
Phase: Operation
Common Consequences:
Scope: Availability. Impact: DoS: Amplification, DoS: Resource Consumption (CPU), DoS: Resource
CWE
Insufficient Control of Network Message Volume (Network Amplification)
mitre_cwe
CWE-406 Insufficient Control of Network Message Volume (Network Amplification)
CWE-406: Insufficient Control of Network Message Volume (Network Amplification)
The product does not sufficiently monitor or control transmitted network traffic volume, so that an actor can cause the product to transmit more traffic than should be allowed for that actor.
In the absence of a policy to restrict asymmetric resource consumption, the application or system cannot distinguish between legitimate transmissions and traffic intended to serve as an amplifying attack on target systems. Systems can often be configured to restrict the amount of traffic sent out on behalf of a client, based on the client's origin or access level. This is usually defined in a resource allocation policy. In the absence of a mechanism to keep track of transmissions, the system or application can be easily
CWE
Incorrectly Specified Destination in a Communication Channel
mitre_cwe
CWE-941 Incorrectly Specified Destination in a Communication Channel
CWE-941: Incorrectly Specified Destination in a Communication Channel
The product creates a communication channel to initiate an outgoing request to an actor, but it does not correctly specify the intended destination for that actor.
Attackers at the destination may be able to spoof trusted servers to steal data or cause a denial of service. There are at least two distinct weaknesses that can cause the product to communicate with an unintended destination: If the product allows an attacker to control which destination is specified, then the attacker can cause it to connect to an untrusted or malicious destination. For example, because UDP is a connectionless protocol, UDP packets can be spoofed by specifying a false source address in the packet; when the server receives the packet and se
1998-01-05
Published