CVE-2000-0095 in HP-UX
Summary
by MITRE
The PMTU discovery procedure used by HP-UX 10.30 and 11.00 for determining the optimum MTU generates large amounts of traffic in response to small packets, allowing remote attackers to cause the system to be used as a packet amplifier.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 04/20/2026
The vulnerability described in CVE-2000-0095 represents a significant network-level security flaw in HP-UX operating systems version 10.30 and 11.00 that exploits the Path MTU Discovery (PMTUD) mechanism. This vulnerability specifically targets the way these systems handle PMTU discovery procedures when processing small packets, creating an exploitable condition that enables malicious actors to leverage the affected systems as packet amplifiers. The flaw exists within the network stack implementation where the system responds disproportionately to certain packet sizes and types, generating excessive network traffic in response to minimal input.
The technical implementation of this vulnerability stems from the PMTU discovery protocol's handling of ICMP messages and packet fragmentation. When HP-UX systems receive small packets that trigger PMTU discovery, they generate large volumes of ICMP redirect messages and other network traffic to determine the optimal MTU size for packet transmission. This process becomes exponentially amplified when attackers craft specific packet patterns that cause the system to continuously send large responses to small requests, effectively creating a network-based amplification attack vector. The flaw operates at the network layer and can be classified under CWE-129 as an improper limitation of a recognized maximum, specifically in the context of network traffic amplification.
The operational impact of this vulnerability allows remote attackers to conduct denial-of-service attacks with minimal resources by exploiting the amplification effect. An attacker can send small packets to the target system and observe the generation of large responses that are then forwarded to victim systems, creating a distributed amplification attack. This technique enables attackers to overwhelm network resources at the victim endpoint while consuming minimal bandwidth from the attack source. The vulnerability essentially transforms the compromised HP-UX system into a network amplifier that can be used to flood target networks with traffic volumes significantly larger than the original attack packets, making it particularly dangerous in network environments where such systems are accessible from the internet.
Security mitigation strategies for this vulnerability include implementing proper firewall rules to restrict ICMP traffic, disabling or limiting PMTU discovery functionality where possible, and configuring network devices to drop suspicious ICMP redirect messages. Network administrators should also consider implementing rate limiting on ICMP traffic and monitoring for unusual traffic patterns that may indicate amplification attacks. The vulnerability aligns with attack patterns documented in the MITRE ATT&CK framework under the network denial of service technique, specifically targeting network infrastructure to create resource exhaustion conditions. Organizations should also implement proper network segmentation and access controls to limit exposure of affected systems to external networks, as well as ensure timely patching of affected HP-UX versions to address the underlying implementation flaw in the PMTU discovery mechanism.