CVE-1999-1171: Medium severity Ipswitch IMail vulnerability
IPswitch WSFTP allows local users to gain additional privileges and modify or add mail accounts by setting the "flags" registry key to 1920.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Ensure the WS_FTP 'flags' registry key is not set to 1920. If the key is set to 1920, change it to a non‑privileged value (consult vendor documentation) to prevent local users from gaining additional privileges or modifying/adding mail accounts.
Progress Software WS_FTP 'flags' registry key flags = not 1920 - Configuration
Restrict the registry ACLs for the 'flags' key so that only administrative accounts can modify it; remove write permissions for local/non‑administrative users.
WS_FTP 'flags' registry key permissions/ACL = Administrators only write access - Operational
Audit affected systems for signs of exploitation: review registry change logs for the 'flags' key and WS_FTP/IMail logs for any created or modified mail accounts. Revert unauthorized changes and remove any unauthorized mail accounts.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-1171?
CVE-1999-1171 is considered a high severity vulnerability due to the potential for local users to gain additional privileges.
How do I fix CVE-1999-1171?
To fix CVE-1999-1171, ensure that the "flags" registry key is set correctly and review access controls for local users.
Which versions are affected by CVE-1999-1171?
CVE-1999-1171 affects Ipswitch WS_FTP Server versions 1.0.1.e and 1.0.2.e, as well as IMail version 5.0.
What is the impact of exploiting CVE-1999-1171?
Exploiting CVE-1999-1171 allows local users to modify or add mail accounts, potentially compromising user data.
Who is vulnerable to CVE-1999-1171?
Organizations using affected versions of Ipswitch WS_FTP Server and IMail are vulnerable to CVE-1999-1171.