CVE-1999-0524: ICMP information such as (1) netmask and (2) timestamp is allowed from arbitrary hosts.

Security readout for executives and security teams

A device on your network answers ICMP queries that reveal its subnet mask and system clock to anyone who asks. On its own this is not a break-in, but it hands attackers reconnaissance data that helps them map your network and refine later attacks. Most modern firewalls block this by default, so the practical risk is usually low but non-zero. Any host or network appliance reachable by ICMP that has not been hardened to suppress Type 13 and Type 17 responses. Internet-exposed routers, load balancers, firewalls, and legacy Unix systems are the most common responders; internal segments where ICMP is unrestricted are also affected. Low priority housekeeping item. It rarely causes direct harm but appears repeatedly in audit and compliance reports, so closing it improves scan hygiene and reduces reconnaissance value for attackers. Fold remediation into routine network hardening rather than treating it as an incident. Mitigation focus: Block inbound ICMP Type 13 (timestamp) and Type 17 (address mask) at the perimeter firewall.; Apply vendor hardening guidance from F5 K15277, Juniper JSA10705, VMware KB 1434, and McAfee SB10053.; Disable ICMP timestamp and netmask replies on host operating systems where supported..

Prepared

Jul 12, 2026, 06:17 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.