PT-1997-1001 · Apple+10 · Apple Macos+12

Published 1997-08-01 · Updated 2026-05-28 · CVE-1999-0524

Positive Technologies (AI Summary)

CVSS v3.1

4.0

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Mac OS versions (affected versions not specified) Cisco IOS versions (affected versions not specified) HP-UX versions (affected versions not specified) Tru64 UNIX versions (affected versions not specified) AIX versions (affected versions not specified) OS/2 versions (affected versions not specified) Windows versions (affected versions not specified) Novell Netware versions (affected versions not specified) Solaris versions (affected versions not specified) IRIX versions (affected versions not specified) SCO Unix versions (affected versions not specified) bsdos versions (affected versions not specified) Linux versions (affected versions not specified)

Description The issue is related to the fact that ICMP information, such as netmask and timestamp, is allowed from arbitrary hosts. Exploitation of this issue may allow an attacker to disclose protected information.

Recommendations For Mac OS, consider restricting access to ICMP information to minimize the risk of exploitation. For Cisco IOS, consider disabling the reception of ICMP information from arbitrary hosts until a fix is available. For HP-UX, restrict access to the netmask and timestamp information in ICMP packets. For Tru64 UNIX, consider implementing firewall rules to block ICMP packets from unknown hosts. For AIX, restrict access to ICMP information to trusted hosts only. For OS/2, consider disabling the ICMP protocol temporarily until a patch is available. For Windows, restrict access to the netmask and timestamp information in ICMP packets. For Novell Netware, consider implementing firewall rules to block ICMP packets from unknown hosts. For Solaris, restrict access to ICMP information to trusted hosts only. For IRIX, consider disabling the reception of ICMP information from arbitrary hosts until a fix is available. For SCO Unix, restrict access to the netmask and timestamp information in ICMP packets. For bsdos, consider implementing firewall rules to block ICMP packets from unknown hosts. For Linux, restrict access to ICMP information to trusted hosts only.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2023-07161

CVE-1999-0524

Affected Products

Aix

Cisco Ios

Hp-Ux

Irix

Linux

Apple Macos

Novell Netware

Os/2

Sco Unix

Solaris

Tru64 Unix

Windows

Bsdos

References · 20

• https://bdu.fstec.ru/vul/2023-07161 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-1999-0524 · Security Note
• http://descriptions.securescout.com/tc/11010 · Note
• http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705 · Note
• http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705 · Note
• https://community.cisco.com/t5/other-security-subjects/i-need-a-fix-for-cve-1999-0524/td-p/3907698 · Note
• https://vuldb.com/ru/?id.13960 · Note
• https://fortiguard.com/encyclopedia/ips/12987 · Note
• https://t.me/cveNotify/165065 · Telegram Post
• https://support.f5.com/csp/article/K15277 · Note
• https://reddit.com/r/sysadmin/comments/15rvdmy/how_to_fix_cve19990524_icmp_timestamp_request · Note
• https://t.me/cvenotify/37649 · Telegram Post
• http://kb.vmware.com/selfservice/microsites/search.do?cmd=displayKC&externalId=1434 · Note
• https://kc.mcafee.com/corporate/index?page=content&id=SB10053 · Note
• http://osvdb.org/95 · Note