CVE-1999-0911: Buffer Overflow
Buffer overflow in ProFTPD, wu-ftpd, and beroftpd allows remote attackers to gain root access via a series of MKD and CWD commands that create nested directories.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
ProFTPDfrom your environment.Uninstall ProFTPD if the service is not required.
- Configuration
Stop and disable the ProFTPD service until a patch or fixed version is available.
ProFTPD service_enabled = false - Compensating control
Restrict network access to the FTP service (e.g., via firewall/ACLs, network segmentation, or blocking FTP at the perimeter) to trusted IPs only to prevent exploitation via MKD/CWD commands.
- Operational
Assume potential root compromise for exposed systems: perform incident response and forensics, rotate any credentials (including root/administrative accounts) that may have been exposed, and rebuild or restore affected hosts if compromise is confirmed.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-0911?
CVE-1999-0911 is considered a high severity vulnerability due to its potential to allow remote attackers to gain root access.
How do I fix CVE-1999-0911?
To fix CVE-1999-0911, upgrade your ProFTPD, wu-ftpd, or beroftpd to a patched version that addresses the buffer overflow vulnerability.
What software is affected by CVE-1999-0911?
CVE-1999-0911 affects ProFTPD versions 1.2_pre1 through 1.2_pre5, as well as wu-ftpd and beroftpd.
How does CVE-1999-0911 exploit a vulnerability?
CVE-1999-0911 exploits a buffer overflow via a series of MKD and CWD commands that create deeply nested directories.
What are the potential impacts of CVE-1999-0911?
The potential impacts of CVE-1999-0911 include unauthorized remote access and control of the affected system by attackers.