CVE-1999-1475: Medium severity Proftpd Project Proftpd vulnerability
ProFTPd 1.2 compiled with the modsqlpw module records user passwords in the wtmp log file, which allows local users to obtain the passwords and gain privileges by reading wtmp, e.g. via the last command.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
proftpd/mod_sqlpwfrom your environment.Remove or disable the mod_sqlpw module. Rebuild or reinstall ProFTPD without the mod_sqlpw module so passwords are not recorded in the wtmp log.
- Compensating control
Restrict read access to the wtmp log file so non‑privileged local users cannot read it (e.g., tighten file permissions/group membership to administrative users only).
- Operational
Rotate any user passwords that may have been recorded in the wtmp log and invalidate/replace any credentials or sessions that may have been exposed.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-1475?
CVE-1999-1475 is considered a high severity vulnerability due to the ease of recovering user passwords from the wtmp log file.
How do I fix CVE-1999-1475?
To fix CVE-1999-1475, it is recommended to upgrade ProFTPd to a version that does not compile the mod_sqlpw module.
Who is affected by CVE-1999-1475?
Users of ProFTPd version 1.2 that have compiled it with the mod_sqlpw module enabled are at risk of CVE-1999-1475.
What impact does CVE-1999-1475 have on system security?
CVE-1999-1475 can lead to privilege escalation by allowing local users to obtain sensitive passwords stored in the wtmp log file.
What are the potential consequences of CVE-1999-1475?
The potential consequences include unauthorized access and control over the FTP service, leading to broader system compromises.