CVE-1999-0524 (Plugin ID 11014) | N-Series | OS6 |

Summary: CVE-1999-0524 (ICMP Timestamp Request Remote Date Disclosure) is detected by VA scanners in OS6.

This article applies to This article does not apply to This article is not tied to any specific product. Not all product versions are identified in this article.
Check out other resources

Symptoms

VA scanners (e.g. Teneable Nessus) detect CVE-1999-0524 in OS6.

Cause

CVE-1999-0524 is detected by VA scanners when icmp timestamp request is answered by OS6.
ICMP Timestamp Request Remote Date Disclosure | Tenable This hyperlink is taking you to a website outside of Dell Technologies.
ICMP type 13 "icmp timestamp request" is allowed in OS6 by default.

Resolution

Here's a sample workaround to CVE-1999-0524, which is to deny ICMP type 13 and type 14 by ACL and apply it to management VLAN. 
OS6# show running-config | section access-list

ip access-list icmp_timestamp_deny
1000 deny icmp any any icmp-type 13
1010 deny icmp any any icmp-type 14
1020 permit every


OS6# show running-config interface vlan 204

ip address 192.168.149.35 255.255.252.0
ip access-group icmp_timestamp_deny in 1
ip access-group icmp_timestamp_deny out 1


OS6# show ip access-lists icmp_timestamp_deny

IP ACL Name: icmp_timestamp_deny
Inbound VLAN(s):
 204
Outbound VLAN(s):
 204

Rule Number: 1000
Action......................................... deny
Match All...................................... FALSE
Protocol....................................... 1(icmp)
Source IP Address.............................. any
Destination IP Address......................... any
ICMP Type...................................... 13
ACL Hit Count.................................. 5

Rule Number: 1010
Action......................................... deny
Match All...................................... FALSE
Protocol....................................... 1(icmp)
Source IP Address.............................. any
Destination IP Address......................... any
ICMP Type...................................... 14
ACL Hit Count.................................. 0

Rule Number: 1020
Action......................................... permit
Match All...................................... TRUE
ACL Hit Count.................................. 1126

 

If OOB is the target for VA scan, CVE-1999-0524 will be detected by VA scanners.
As ACL cannot be applied to OOB, a firewall needs to deny ICMP-type 13 and 14.

This is the output of ICMP request and reply with type 13 & 14 to/from 192.168.35.210 assigned to OOB IP address in OS6.

[root@localhost ~]# nping  --icmp-type=13 192.168.35.210

Starting Nping 0.7.92 ( https://nmap.org/nping ) at 2024-07-04 12:01 +08
SENT (0.0116s) ICMP [192.168.200.3 > 192.168.35.210 Timestamp request (type=13/code=0) id=32916 seq=1 orig=0 recv=0 trans=0] IP [ttl=64 id=62216 iplen=40 ]
RCVD (0.0123s) ICMP [192.168.35.210 > 192.168.200.3 Timestamp reply (type=14/code=0) id=32916 seq=1 orig=0 recv=15056645 trans=15056645] IP [ttl=64 id=29988 iplen=40 ]

 

Affected Products

PowerSwitch N1100-ON Series, PowerSwitch N1500 Series, PowerSwitch N2000 Series, PowerSwitch N2100 Series, PowerSwitch N2200-ON Series, PowerSwitch N3000 Series, PowerSwitch N3000E-ON Series, PowerSwitch N3100 Series, PowerSwitch N3200-ON , PowerSwitch N4000 Series ...
Article Properties
Article Number: 000226667
Article Type: Solution
Last Modified: 12 Jul 2024
Version:  2
Find answers to your questions from other Dell users
Support Services
Check if your device is covered by Support Services.