Security readout for executives and security teams
Plain-English summary
An old flaw in Windows NT DNS servers allowed attackers to crash the service by sending a spoofed DNS response that didn't match any query the server actually made. The result was a denial of service, meaning name resolution could stop working until the DNS service was restarted. This CVE dates to 1999 and applies to long-unsupported Windows NT systems.
Executive priority
Low priority. This is a 1999-era denial-of-service issue in an operating system that has been unsupported for many years. Action is only relevant if legacy Windows NT DNS remains anywhere in the environment, in which case decommissioning is the real priority.
Technical view
Per the CVE record, Windows NT DNS servers could be forced into a denial-of-service condition when they processed a maliciously crafted DNS packet that contained a response to a query the server never issued. The source bundle does not list a CVSS score, CWE, or specific NT build. No KEV entry exists. Only an X-Force reference is cited, and no vendor patch is named in the provided sources.
Likely exposure
Exposure is limited to legacy Windows NT DNS servers, which are decades past end-of-life. Any organization still running NT DNS today would face broader risk far exceeding this single CVE. Modern Windows Server DNS is not indicated as affected in the provided sources.
Exploitation context
The sources do not indicate active exploitation, and the CVE is not on CISA KEV. The described impact is denial of service, not code execution or data disclosure. No exploit maturity or in-the-wild activity is referenced in the provided bundle.
Researcher notes
Source bundle is sparse: no CVSS, CWE, affected CPE, or vendor advisory link beyond an X-Force reference. Root cause appears to be inadequate validation of unsolicited DNS response packets on NT's DNS service. Not on KEV. Treat any current detection of NT DNS as a modernization problem rather than a patching exercise; verify against Microsoft historical guidance before assuming safe.
Mitigation direction
- Retire or isolate any remaining Windows NT DNS servers, which are end-of-life.
- Migrate DNS services to a supported Windows Server or equivalent modern DNS platform.
- Restrict inbound DNS traffic to trusted resolvers and upstream sources.
- Consult Microsoft legacy guidance for any residual NT-era systems still in scope.
Validation and detection
- Inventory DNS infrastructure to confirm no Windows NT hosts remain in production.
- Verify DNS servers are running a currently supported operating system version.
- Confirm perimeter and internal filtering restrict unsolicited DNS responses to authoritative and resolver hosts.
- Review monitoring for DNS service crashes or restarts that could indicate malformed-response abuse.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-1999-0274 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://exchange.xforce.ibmcloud.com/vulnerabilities/CVE-1999-0274CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.