Vulnerability record · CVE-1999-0513 · published 5 January 1998
CVE-1999-0513: Unix ICMP Broadcast Response Enables Smurf Denial of Service
DDigital · Unix
Multiple Unix-derived systems respond to ICMP echo requests sent to broadcast addresses, which lets an attacker use those hosts as traffic amplifiers in a Smurf attack. The flaw matters because a single spoofed packet stream can generate enough reflected traffic to saturate a victim's link and take it offline.
Description
ICMP messages to broadcast addresses are allowed, allowing for a Smurf attack that can cause a denial of service.
AV:N/AC:L/Au:N/C:N/I:N/A:P
Automated analysis
medium priorityThe flaw is a well-understood availability-only DoS with no confidentiality or integrity impact, but the high EPSS score and broad multi-vendor exposure keep it relevant on unhardened networks.
What it is
Multiple Unix-derived systems respond to ICMP echo requests sent to broadcast addresses, which lets an attacker use those hosts as traffic amplifiers in a Smurf attack. The flaw matters because a single spoofed packet stream can generate enough reflected traffic to saturate a victim's link and take it offline.
Impact
An attacker can cause a denial of service against a spoofed victim address by directing amplified ICMP replies at it. The attacker gains no data access or code execution; the effect is purely availability loss.
Attack surface
Reachable over the network with no authentication and no user interaction, per the AV:N/AC:L/Au:N vector. Any host that answers ICMP to a broadcast address on a network allowing directed broadcasts is a potential amplifier.
Exploitation
Not listed in CISA KEV and no exploit tags appear in the references, but EPSS is 0.70934 (99.4th percentile), indicating a high modeled likelihood of exploitation activity. The technique is long-established and widely scripted.
What to do
- Apply vendor patches or configuration fixes that stop hosts from responding to ICMP echo requests sent to broadcast addresses.
- Disable directed broadcast forwarding on routers and layer-3 switches at network boundaries.
- Block or rate-limit inbound ICMP echo to broadcast addresses at the perimeter and on internal segments.
- Enable anti-spoofing (uRPF or equivalent) to prevent forged source addresses leaving your network.
- Monitor for large outbound ICMP reply volumes toward a single destination as an early DoS indicator.
Detection
- Alert on ICMP echo requests with broadcast or subnet-directed broadcast destination addresses.
- Baseline and alert on abnormal spikes in outbound ICMP echo replies from a single host or subnet.
- Correlate many hosts replying to one spoofed source address within a short window.
- Review router and firewall logs for directed broadcast forwarding being permitted.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
8 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-1999-0513 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-1999-0513), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
