CVE-1999-0017: High severity GNU Inet vulnerability
FTP servers can allow an attacker to connect to arbitrary ports on machines other than the FTP client, aka FTP bounce.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable any FTP server functionality that permits connecting to addresses or ports on third-party machines (FTP bounce). Configure the server so it will only initiate data/active-mode connections to the authenticated FTP client's IP address.
FTP server third-party connections (FTP bounce) = disabled - Compensating control
At the network edge, block or restrict outbound connections from FTP servers to arbitrary internal or external hosts/ports. Allow outbound connections from the FTP server only to the authenticated client IPs and required management destinations.
- Operational
Audit FTP server logs and network traffic for signs of FTP bounce usage and review configurations to ensure bounce/proxy features remain disabled.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-0017?
The severity of CVE-1999-0017 is considered to be high due to its potential to allow unauthorized access to arbitrary ports on remote machines.
How do I fix CVE-1999-0017?
To fix CVE-1999-0017, it is recommended to upgrade to a version of the affected FTP server software that has patched this vulnerability.
Which software versions are affected by CVE-1999-0017?
CVE-1999-0017 affects several versions of GNU Inet, Wu-FTPD, FreeBSD, IBM AIX, and Sun SunOS, among others.
What is FTP bounce as described in CVE-1999-0017?
FTP bounce refers to the ability of an attacker to use an FTP server to send requests to other ports on different machines, potentially bypassing firewall restrictions.
Is CVE-1999-0017 still a relevant vulnerability today?
While CVE-1999-0017 is an older vulnerability, it remains relevant for legacy systems that still use vulnerable FTP servers.