CVE-1999-0997: High severity University of Washington Wu-ftpd vulnerability
wu-ftp with FTP conversion enabled allows an attacker to execute commands via a malformed file name that is interpreted as an argument to the program that does the conversion, e.g. tar or uncompress.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable FTP conversion in wu-ftp configuration so uploaded filenames are not interpreted as arguments to external conversion programs (e.g., tar, uncompress).
wu-ftp FTP conversion = disabled
Event History
Frequently Asked Questions
What is the severity of CVE-1999-0997?
CVE-1999-0997 is considered a critical vulnerability due to the potential for remote command execution by attackers.
How do I fix CVE-1999-0997?
To fix CVE-1999-0997, upgrade to the latest patched version of the affected FTP software that resolves this vulnerability.
Which software is affected by CVE-1999-0997?
CVE-1999-0997 affects specific versions of wu-ftp and anonftp as well as Red Hat Linux 5.2, 6.0, and 6.1.
What are the potential impacts of CVE-1999-0997?
The potential impacts of CVE-1999-0997 include unauthorized command execution, which can lead to data loss or system compromise.
Can CVE-1999-0997 be exploited remotely?
Yes, CVE-1999-0997 can be exploited remotely by attackers with the ability to send malformed file names to the FTP service.