CVE-1999-1148: Medium severity microsoft internet information server vulnerability
FTP service in IIS 4.0 and earlier allows remote attackers to cause a denial of service (resource exhaustion) via many passive (PASV) connections at the same time.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Microsoft Internet Information Services (FTP service)from your environment.Uninstall or disable the IIS FTP service if FTP functionality is not required.
- Configuration
Disable passive (PASV) FTP mode if not required; otherwise configure the IIS FTP service to limit the number of simultaneous PASV connections to prevent resource exhaustion.
Microsoft Internet Information Services (FTP service) PASV (passive) mode / concurrent PASV connections = disabled or limited - Compensating control
Restrict FTP access at the network perimeter (firewall/ACL). Block or limit access to TCP port 21 and restrict or firewall the passive data port range to trusted IPs and/or apply rate-limiting to prevent large numbers of simultaneous PASV connections.
- Operational
Monitor FTP connection counts and server resource usage for excessive PASV connections; alert on spikes and, if resource exhaustion occurs, restart the FTP service and investigate logs to identify abusive clients.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-1148?
CVE-1999-1148 is classified as a denial of service vulnerability due to resource exhaustion risks.
How do I fix CVE-1999-1148?
To mitigate CVE-1999-1148, consider upgrading to a more recent version of IIS that is not vulnerable.
What systems are affected by CVE-1999-1148?
CVE-1999-1148 affects Microsoft Internet Information Server versions 4.0 and earlier.
What type of attack does CVE-1999-1148 exploit?
CVE-1999-1148 is exploited through simultaneous passive (PASV) FTP connections that overload the server.
Is there a workaround for CVE-1999-1148?
A possible workaround for CVE-1999-1148 is to limit the number of concurrent FTP connections to reduce the risk of resource exhaustion.