CVE-1999-0305 in FreeBSD
Summary
by MITRE
The system configuration control (sysctl) facility in BSD based operating systems OpenBSD 2.2 and earlier, and FreeBSD 2.2.5 and earlier, does not properly restrict source routed packets even when the (1) dosourceroute or (2) forwarding variables are set, which allows remote attackers to spoof TCP connections.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 04/17/2026
The vulnerability described in CVE-1999-0305 resides within the system configuration control facility known as sysctl in BSD-based operating systems including OpenBSD 2.2 and earlier versions and FreeBSD 2.2.5 and earlier versions. This issue represents a critical flaw in network security implementation that directly impacts the operating system's ability to properly handle source routing packets. The vulnerability specifically manifests when the dosourceroute or forwarding variables are configured, yet the system fails to adequately restrict source routed packets, creating an exploitable condition that undermines network security controls.
The technical flaw stems from improper enforcement of source route restrictions within the kernel's network stack implementation. When these configuration variables are set to disable source routing, the system should prevent incoming packets that contain source routing information from being processed or forwarded. However, the vulnerability allows source routed packets to bypass these restrictions, enabling attackers to manipulate the routing information embedded within TCP packets. This occurs because the kernel's packet processing logic does not properly validate or filter packets based on their source routing headers even when explicit configuration directives have been issued to disable such functionality.
The operational impact of this vulnerability is significant as it provides remote attackers with the capability to spoof TCP connections through manipulation of source routing information. This technique allows adversaries to establish connections that appear to originate from legitimate sources, potentially bypassing security controls that rely on source address validation. The vulnerability directly enables man-in-the-middle attacks, connection hijacking, and other network-level exploits that can compromise system integrity and confidentiality. Network administrators who rely on source routing restrictions for security purposes find their protection measures rendered ineffective, creating potential entry points for unauthorized access and data exfiltration.
The vulnerability aligns with CWE-284, which describes improper access control in network protocols, and represents a classic example of insufficient input validation within kernel network processing components. From an ATT&CK framework perspective, this vulnerability maps to techniques involving network sniffing, connection hijacking, and evasion of network security controls. The flaw essentially creates a backdoor mechanism that allows attackers to circumvent normal network traffic filtering and routing policies. Organizations using affected versions of BSD-based systems face increased risk of network infiltration, as attackers can exploit this weakness to establish covert communication channels or manipulate existing connections. The vulnerability demonstrates how seemingly simple configuration management issues can result in fundamental breakdowns of network security architecture, emphasizing the critical importance of proper kernel-level security implementation.
Mitigation strategies should focus on immediate system updates to patched versions of OpenBSD and FreeBSD that address the source route handling flaw. System administrators must also implement additional network-level controls such as firewall rules that explicitly block source routed packets, and consider disabling source routing entirely at the network infrastructure level. Regular security auditing of system configuration parameters and network traffic monitoring should be implemented to detect potential exploitation attempts. Organizations should also review their network security policies to ensure proper handling of source routing information and maintain awareness of similar vulnerabilities in other operating system components that may present analogous security risks.