CVE-1999-0183: Medium severity TFTP TFTP vulnerability
Linux implementations of TFTP would allow access to files outside the restricted directory.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Linux TFTP serverfrom your environment.Uninstall or disable the TFTP server if it is not required.
- Configuration
Configure the TFTP server to run in a chroot or otherwise enforce its restricted directory so clients cannot access files outside the intended root.
Linux TFTP server enforce chroot / restrict root directory = enabled - Compensating control
Restrict access to the TFTP service to only trusted IP ranges using firewall rules, network ACLs, or host-based firewall to reduce exposure.
- Operational
Audit TFTP server logs and the filesystem for evidence of access to files outside the restricted directory; remove any unauthorized files and remediate any data exposure.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-0183?
CVE-1999-0183 is classified as a medium severity vulnerability due to its potential to allow unauthorized file access.
How do I fix CVE-1999-0183?
To fix CVE-1999-0183, update your TFTP implementation to a patched version that restricts access to files within designated directories.
Which Linux versions are affected by CVE-1999-0183?
CVE-1999-0183 affects various Linux distributions using vulnerable TFTP implementations, specifically versions of the Linux kernel around 2.6.20.1.
What attack vectors does CVE-1999-0183 expose?
CVE-1999-0183 can be exploited remotely through TFTP to access sensitive files outside of the restricted directory.
Is CVE-1999-0183 exploitable on all systems using TFTP?
CVE-1999-0183 is exploitable on systems using vulnerable versions of TFTP, but mitigations may reduce the risk.