Vulnerability record · CVE-1999-0016 · published 1 December 1997
CVE-1999-0016: Land IP Denial of Service in Multiple TCP/IP Stacks
Cisco · Ios
The Land attack is a denial-of-service condition triggered by a crafted TCP SYN packet whose source and destination IP addresses and ports are identical. Affected TCP/IP implementations in Cisco IOS, GNU inet, Microsoft Winsock, HP-UX, NetBSD, Windows 95/Windows NT, and SunOS mishandle the resulting connection state, causing the host to stall or crash. The flaw matters because it is remotely reachable without authentication and can take a system off the network with a single packet.
Description
Land IP denial of service.
AV:N/AC:L/Au:N/C:N/I:N/A:P
Automated analysis
high priorityThe flaw is remotely exploitable without authentication and has a very high EPSS score, though it is not in CISA KEV and only causes denial of service.
What it is
The Land attack is a denial-of-service condition triggered by a crafted TCP SYN packet whose source and destination IP addresses and ports are identical. Affected TCP/IP implementations in Cisco IOS, GNU inet, Microsoft Winsock, HP-UX, NetBSD, Windows 95/Windows NT, and SunOS mishandle the resulting connection state, causing the host to stall or crash. The flaw matters because it is remotely reachable without authentication and can take a system off the network with a single packet.
Impact
An attacker can cause a denial of service, making the targeted host unresponsive or crashing its network stack. No confidentiality or integrity impact is described; the effect is availability loss.
Attack surface
Reachable over the network via a single spoofed TCP packet to a listening port; no authentication or user interaction is required. The CVSS vector AV:N/AC:L/Au:N confirms remote, low-complexity, unauthenticated exploitation.
Exploitation
CISA KEV does not list this CVE, but EPSS is very high (0.95739, 99.869th percentile), indicating elevated predicted exploitation activity. Reference tags are empty, so no vendor or third-party confirmation of active exploitation is provided in the record.
What to do
- Apply vendor patches or firmware updates for the affected TCP/IP stacks (Cisco IOS, HP-UX, NetBSD, SunOS, Windows 95/NT, GNU inet) as available from each vendor.
- Enable ingress and egress filtering (BCP 38 / RFC 2827) to block packets with spoofed or invalid source addresses.
- Configure network devices and host firewalls to drop TCP packets where source and destination IP addresses are identical.
- Disable or restrict unnecessary network services and use TCP SYN cookies or equivalent protections where supported.
- Retire or isolate end-of-life systems such as Windows 95, Windows NT, and SunOS that cannot be patched.
Detection
- Monitor network traffic for TCP SYN packets with matching source and destination IP addresses and ports.
- Alert on firewall or IDS/IPS signatures for Land attack patterns (identical src/dst IP and port).
- Track host availability and unexpected TCP stack resets or crashes correlated with inbound SYN floods.
- Review router and switch logs for spoofed-source packets or martian address drops.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
8 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-1999-0016 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-1999-0016), CISA KEV, FIRST EPSS (scores of 2026-09-24). This page is refreshed as NVD updates the record.
