Read the docs
TI-1999-00517 Aliases CVE-1999-0524GHSA-5qg4-5cpf-4r9p

ICMP information such as (1) netmask and (2) timestamp is allowed from arbitrary hosts.

Priority MEDIUM 43CWE-200Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
None · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-200.

Summary

ICMP information such as (1) netmask and (2) timestamp is allowed from arbitrary hosts.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.32154 98th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 14

CPEVersionsRoleVendor
cpe:2.3:o:apple:mac_os_x:-:*:*:*:*:*:*:*not specified by NVDVulnerableApple
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*not specified by NVDVulnerableApple
cpe:2.3:o:cisco:ios:-:*:*:*:*:*:*:*not specified by NVDVulnerableCisco
cpe:2.3:o:hp:hp-ux:-:*:*:*:*:*:*:*not specified by NVDVulnerableHewlett Packard Enterprise
cpe:2.3:o:hp:tru64:-:*:*:*:*:*:*:*not specified by NVDVulnerableHewlett Packard Enterprise
cpe:2.3:o:ibm:aix:-:*:*:*:*:*:*:*not specified by NVDVulnerableIBM
cpe:2.3:o:ibm:os2:-:*:*:*:*:*:*:*not specified by NVDVulnerableIBM
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*not specified by NVDVulnerableLinux
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*not specified by NVDVulnerableMicrosoft
cpe:2.3:o:novell:netware:-:*:*:*:*:*:*:*not specified by NVDVulnerableNovell
  • cpe:2.3:o:apple:mac_os_x:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Apple
  • cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Apple
  • cpe:2.3:o:cisco:ios:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Cisco
  • cpe:2.3:o:hp:hp-ux:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Hewlett Packard Enterprise
  • cpe:2.3:o:hp:tru64:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Hewlett Packard Enterprise
  • cpe:2.3:o:ibm:aix:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·IBM
  • cpe:2.3:o:ibm:os2:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·IBM
  • cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Linux
  • cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Microsoft
  • cpe:2.3:o:novell:netware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Novell
Show 4 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:oracle:solaris:-:*:*:*:*:*:-:*not specified by NVDVulnerableOracle
cpe:2.3:o:sco:sco_unix:-:*:*:*:*:*:*:*not specified by NVDVulnerableSco
cpe:2.3:o:sgi:irix:-:*:*:*:*:*:*:*not specified by NVDVulnerableSgi
cpe:2.3:o:windriver:bsdos:-:*:*:*:*:*:*:*not specified by NVDVulnerableWind River
  • cpe:2.3:o:oracle:solaris:-:*:*:*:*:*:-:* Versions not specified by NVD Vulnerable ·Oracle
  • cpe:2.3:o:sco:sco_unix:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Sco
  • cpe:2.3:o:sgi:irix:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Sgi
  • cpe:2.3:o:windriver:bsdos:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Wind River

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-1999-0524
  2. 2026-10-03 Alias added: GHSA-5qg4-5cpf-4r9p

References

Advisory 2

Other 4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences