CVE-1999-0305: The system configuration control (sysctl) facility in BSD based operating systems OpenBSD 2.2 and earlier,...

Security readout for executives and security teams

A late-1990s flaw in older BSD systems allowed attackers on the internet to trick these servers into accepting network traffic that appeared to come from trusted sources. The systems ignored their own safety settings meant to block this behavior. In plain terms, an attacker could impersonate another computer and hijack or forge connections. Only OpenBSD 2.2 and earlier and FreeBSD 2.2.5 and earlier are named, so the practical footprint today is minimal. Extremely limited today. Only OpenBSD 2.2 (and earlier) and FreeBSD 2.2.5 (and earlier) are identified. These releases are decades out of support and unlikely to be present in production. Any remaining exposure would be legacy or museum systems reachable from untrusted networks with source-routed packets not otherwise filtered upstream. Low priority for modern environments. Treat as hygiene: ensure no legacy BSD systems from the late 1990s remain internet-facing, and confirm network devices drop source-routed traffic. Escalate only if asset inventory reveals unsupported BSD hosts in scope. Mitigation focus: Upgrade any surviving OpenBSD 2.2 or FreeBSD 2.2.5 hosts to a currently supported OS release.; Drop IP source-routed packets at perimeter routers, firewalls, and host stacks per vendor guidance.; Refer to the OpenBSD sourceroute advisory for the historical patch and configuration guidance..

Prepared

Jul 12, 2026, 06:30 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.