CVE-1999-0201: Medium severity FTP FTP vulnerability
A quote cwd command on FTP servers can reveal the full path of the home directory of the "ftp" user.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Configure the FTP service used by Foreman to disallow or not respond to the QUOTE CWD command so it cannot reveal the full path of the 'ftp' user's home directory.
Foreman FTP server QUOTE/CWD command handling = disabled - Compensating control
Restrict network access to the affected FTP service (for example, via firewall, ACLs, or VPN) so only trusted IPs or management networks can reach it.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-0201?
CVE-1999-0201 has a low severity rating since it primarily exposes the home directory path without compromising sensitive information.
How do I fix CVE-1999-0201?
To mitigate CVE-1999-0201, configure FTP servers to restrict the use of the 'quote cwd' command or implement appropriate directory permissions.
What systems are impacted by CVE-1999-0201?
CVE-1999-0201 affects FTP server implementations, particularly those utilizing the 'ftp' command.
Is CVE-1999-0201 still relevant today?
While CVE-1999-0201 is an older vulnerability, it remains relevant as some legacy systems may still be in use and need to be secured.
Can CVE-1999-0201 lead to further exploits?
CVE-1999-0201 itself does not directly lead to further exploits, but revealing directory paths could aid an attacker in crafting more targeted attacks.