CVE-1999-0880: Medium severity Caldera OpenLinux vulnerability
Denial of service in WU-FTPD via the SITE NEWER command, which does not free memory properly.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
wu-ftpdfrom your environment.Uninstall or stop the wu-ftpd service on affected BSDI BSD/OS and SCO OpenLinux Server systems if FTP service is not required.
- Configuration
Disable or configure WU-FTPD to reject the SITE NEWER command on affected BSDI BSD/OS and SCO OpenLinux Server systems until an official vendor fix is available.
WU-FTPD SITE NEWER command = disabled or rejected - Compensating control
Restrict or block access to FTP (TCP port 21) at the network perimeter or firewall, or allow FTP only from trusted IP ranges, to prevent remote exploitation of the SITE NEWER command.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-0880?
CVE-1999-0880 is classified as a denial of service vulnerability that can significantly impact the availability of the affected systems.
How do I fix CVE-1999-0880?
To fix CVE-1999-0880, ensure that you upgrade WU-FTPD to the latest version that addresses this memory management issue.
Which systems are affected by CVE-1999-0880?
CVE-1999-0880 affects BSDI BSD OS versions 2.1 and 3.0, as well as SCO OpenLinux Server version 1.0.
What kind of attack does CVE-1999-0880 allow?
CVE-1999-0880 allows attackers to exploit the SITE NEWER command to cause a denial of service condition.
When was CVE-1999-0880 discovered?
CVE-1999-0880 was disclosed in 1999 and has been recognized as a significant vulnerability in WU-FTPD.