Linux Kernel 1.3.0/2.0 ICMP Packet Long Packet denial of service

Summaryinfo

A vulnerability classified as critical has been found in Linux Kernel 1.3.0/2.0. The affected element is an unknown function of the component ICMP Packet Handler. This manipulation as part of Long Packet causes denial of service. The identification of this vulnerability is CVE-1999-0128. Furthermore, there is an exploit available. This vulnerability is historically significant due to its background and the way it was received. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical was found in Linux Kernel 1.3.0/2.0 (Operating System). Affected by this vulnerability is some unknown processing of the component ICMP Packet Handler. The manipulation as part of a Long Packet leads to a denial of service vulnerability. The CWE definition for the vulnerability is CWE-404. The product does not release or incorrectly releases a resource before it is made available for re-use. As an impact it is known to affect availability. The summary by CVE is:

Oversized ICMP ping packets can result in a denial of service, aka Ping o' Death.

The issue has been introduced in 06/12/1995. The weakness was shared 12/18/1996. This vulnerability is known as CVE-1999-0128. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details are unknown but a public exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 04/16/2026). Due to its background and reception, this vulnerability has a historic impact.

It is possible to download the exploit at exploit-db.com. It is declared as highly functional. The vulnerability was handled as a non-public zero-day exploit for at least 555 days. During that time the estimated underground price was around $5k-$25k. The vulnerability scanner Nessus provides a plugin with the ID 11903 (TCP/IP Ping of Death Remote DoS (jolt)), which helps to determine the existence of the flaw in a target environment. It is assigned to the family Denial of Service and running in the context r.

Upgrading eliminates this vulnerability.Proper firewalling of ICMP is able to address this issue. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the databases at X-Force (95), Exploit-DB (324), Tenable (11903) and Vulnerability Center (SBV-647†). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Affected

• IBM AIX
• Linux Kernel
• SCO OpenServer
• Sun SunOS

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 1.3.0
• 2.0

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion