CVE-1999-0955: Race Condition
Race condition in wu-ftpd and BSDI ftpd allows remote attackers to gain root access via the SITE EXEC command.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
wu-ftpdfrom your environment.If wu-ftpd is not required, uninstall/remove the wu-ftpd package until a patched/fixed release is available.
- Configuration
Disable support for the SITE EXEC command in wu-ftpd (or otherwise configure the server to reject/ignore SITE EXEC) to prevent remote execution via that command.
wu-ftpd SITE EXEC command = disabled - Compensating control
Restrict access to the FTP service (port 21) using network controls such as firewall rules, ACLs, or host-based filtering — allow only trusted hosts or internal networks to connect to the FTP server.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-0955?
CVE-1999-0955 is considered to have a critical severity rating due to the potential for remote attackers to gain root access.
How do I fix CVE-1999-0955?
To fix CVE-1999-0955, it is recommended to upgrade to a newer version of wu-ftpd that is not vulnerable, as well as disabling the SITE EXEC command if possible.
What are the known affected versions for CVE-1999-0955?
The only known affected version for CVE-1999-0955 is wu-ftpd 2.4.1.
Who can be affected by CVE-1999-0955?
Any system running the vulnerable version of wu-ftpd is at risk, particularly those exposed to the Internet.
What type of vulnerability is CVE-1999-0955?
CVE-1999-0955 is classified as a race condition vulnerability that allows remote code execution.