CVE-1999-0351: Medium severity FTP FTP PASV vulnerability
FTP PASV "Pizza Thief" denial of service and unauthorized data access. Attackers can steal data by connecting to a port that was intended for use by a client.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable FTP passive mode (PASV) if it is not required to prevent attackers from connecting to data ports intended for clients.
Ftp Ftp Pasv pasv_enabled = false - Compensating control
Restrict access to FTP passive data ports at the network perimeter (firewall/ACL) to trusted hosts only; limit the passive port range and block unexpected inbound connections to those ports.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-0351?
CVE-1999-0351 is classified as a denial of service vulnerability that can also lead to unauthorized data access.
How do I fix CVE-1999-0351?
To fix CVE-1999-0351, it is recommended to update FTP server software to the latest version that addresses this vulnerability.
What impact does CVE-1999-0351 have on FTP services?
CVE-1999-0351 can lead to the disruption of FTP services and potential data theft by unauthorized users.
Which FTP servers are affected by CVE-1999-0351?
CVE-1999-0351 affects FTP servers that implement the PASV command incorrectly, allowing attackers to connect and steal data.
Can CVE-1999-0351 be exploited remotely?
Yes, CVE-1999-0351 can be exploited remotely if the FTP server is accessible over the internet.