CVE-1999-1254 in Windows
Summary
by MITRE
Windows 95, 98, and NT 4.0 allow remote attackers to cause a denial of service by spoofing ICMP redirect messages from a router, which causes Windows to change its routing tables.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 04/19/2026
This vulnerability exists in Microsoft Windows 95, 98, and NT 4.0 operating systems where the implementation of Internet Control Message Protocol ICMP redirect handling contains a critical flaw that enables remote attackers to perform denial of service attacks. The vulnerability stems from the operating systems' failure to properly validate the authenticity of ICMP redirect messages received from network routers, allowing malicious actors to spoof these messages and manipulate the target system's routing behavior.
The technical flaw resides in the lack of proper authentication and validation mechanisms within the ICMP redirect processing code. When Windows systems receive ICMP redirect messages, they automatically update their routing tables without verifying the source of the message or ensuring its legitimacy. This design oversight creates an opportunity for attackers to send forged ICMP redirect packets from unauthorized sources, causing the Windows machine to establish incorrect routing paths for network traffic. The vulnerability is classified under CWE-20 as "Improper Input Validation" and represents a specific implementation weakness in network protocol handling that violates secure coding practices.
The operational impact of this vulnerability is significant as it can lead to complete network disruption for affected systems. When attackers successfully spoof ICMP redirect messages, they can redirect network traffic through malicious paths, potentially causing network connectivity failures, data interception, or complete denial of service for network services. The vulnerability affects systems running Windows 95, 98, and NT 4.0, which were widely deployed in enterprise environments during the late 1990s, making this attack vector particularly dangerous for organizations with legacy systems. The attack can be executed remotely without requiring any special privileges or authentication credentials, making it an attractive target for attackers seeking to disrupt network operations.
From an ATT&CK framework perspective, this vulnerability maps to T1498 as "Network Denial of Service" and demonstrates how protocol implementation flaws can be exploited to compromise system availability. The attack pattern aligns with T1566.001 "Phishing via Service" in cases where attackers might use this vulnerability as part of a broader attack chain, though the primary exploitation method is direct network manipulation. Organizations should implement network segmentation and access control measures to limit the potential impact of such attacks, while also applying the appropriate security patches and updates to address the underlying ICMP handling implementation flaw. The vulnerability highlights the importance of proper network protocol validation and demonstrates how seemingly benign network services can become attack vectors when not properly secured against spoofing attacks.
The remediation approach requires immediate patching of affected systems with the appropriate Microsoft security updates, along with network monitoring to detect suspicious ICMP redirect traffic patterns. Network administrators should also implement ingress filtering and other defensive measures to prevent unauthorized ICMP redirect messages from reaching target systems. Additionally, organizations should consider disabling unnecessary ICMP redirect functionality on critical systems and implementing robust network access controls to minimize the attack surface. This vulnerability serves as a historical example of how network protocol implementation weaknesses can create persistent security risks that require both immediate fixes and long-term architectural improvements to prevent similar issues in modern systems.