BSD ip_input.c IP Fragment Reassembly Denial of Service

CVE-1999-0001 — literally the first CVE identifier ever assigned — is a denial-of-service flaw in ip_input.c, the IPv4 packet reassembly path shared across BSD-derived TCP/IP stacks. A remote, unauthenticated attacker could send crafted IP fragments that crash or hang the kernel network stack. The affected versions are FreeBSD 1.0 through 3.0, OpenBSD 2.3–2.4, and BSDI BSD/OS 3.1. Every one of these reached end-of-life between May 1999 and December 1999. BSDI, the company, no longer exists. No fix was ever backported because the vendors moved on to entirely new major releases within months of disclosure.

The vendor CVSS v2 score of 5.0 (MEDIUM) was a reasonable rating *in 1999* — remote, no-auth, low-complexity, partial-availability impact. But in October 2026, the rating is academically generous. There is no realistic installed base for these OS versions anywhere on Earth. Modern FreeBSD (14.x) and OpenBSD (7.x) rewrote and hardened their IP stacks decades ago. The flaw has zero relevance to any system a defender could plausibly be managing. The vendor severity doesn't match reality — it *wildly overstates* it — because the software is extinct.

Sources.

1. NVD — CVE-1999-0001 Detail
2. CVE CIRCL — CVE-1999-0001
3. Snyk — Improper Input Validation in FreeBSD
4. CVEFeed — CVE-1999-0001
5. Tenable — CVE-1999-0001
6. Steve Christey Coley on CVE-1999-0001 ambiguity (X)
7. endoflife.date — FreeBSD lifecycle
8. endoflife.date — OpenBSD lifecycle

Run on any Linux or BSD auditor workstation as an unprivileged user. Pass the target hostname or IP as the first argument: ./check_cve_1999_0001.sh 10.0.0.5. No special privileges are needed — the script connects via SSH to read the remote OS version string. Requires ssh and uname availability on the target.

#!/usr/bin/env bash
# check_cve_1999_0001.sh — CVE-1999-0001 applicability check
# Checks whether a remote host runs an affected BSD version.
# Usage: ./check_cve_1999_0001.sh <host>
# Exit codes: 0 = PATCHED/NOT_AFFECTED, 1 = VULNERABLE, 2 = UNKNOWN

set -euo pipefail

if [[ $# -lt 1 ]]; then
  echo "Usage: $0 <hostname_or_ip>"
  exit 2
fi

HOST="$1"

# Try to get OS info via uname
OS_INFO=$(ssh -o ConnectTimeout=5 -o BatchMode=yes "$HOST" 'uname -sr' 2>/dev/null) || {
  echo "UNKNOWN — could not connect to $HOST via SSH."
  exit 2
}

case "$OS_INFO" in
  FreeBSD\ 1.*|FreeBSD\ 2.*|FreeBSD\ 3.0*)
    echo "VULNERABLE — $HOST runs $OS_INFO (affected by CVE-1999-0001)."
    exit 1
    ;;
  OpenBSD\ 2.3*|OpenBSD\ 2.4*)
    echo "VULNERABLE — $HOST runs $OS_INFO (affected by CVE-1999-0001)."
    exit 1
    ;;
  *BSD/OS\ 3.1*|*BSDI\ 3.1*)
    echo "VULNERABLE — $HOST runs $OS_INFO (affected by CVE-1999-0001)."
    exit 1
    ;;
  *)
    echo "PATCHED — $HOST runs $OS_INFO (not affected by CVE-1999-0001)."
    exit 0
    ;;
esac