CVE-2000-0129: Buffer Overflow
Buffer overflow in the SHGetPathFromIDList function of the Serv-U FTP server allows attackers to cause a denial of service by performing a LIST command on a malformed .lnk file.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Serv-U FTP serverfrom your environment.Uninstall or stop the Serv-U FTP server until a vendor-supplied patch or fix is available.
- Compensating control
Restrict access to the FTP service using firewall rules or ACLs (limit to trusted IPs/networks) and block or filter LIST operations from untrusted sources to prevent remote exploitation.
- Operational
Remove any .lnk (Windows shortcut) files from directories served by the FTP server so they cannot be used to trigger the vulnerable SHGetPathFromIDList handling.
Event History
Frequently Asked Questions
What is the severity of CVE-2000-0129?
CVE-2000-0129 is a critical vulnerability that allows attackers to exploit a buffer overflow, potentially leading to a denial of service.
How do I fix CVE-2000-0129?
To mitigate CVE-2000-0129, users should update to a non-vulnerable version of the Serv-U FTP server software or apply patches from the vendor.
What does CVE-2000-0129 affect?
CVE-2000-0129 primarily affects Microsoft Windows NT 4.0, Windows 95, and Windows 98 operating systems.
What actions can be taken to protect against CVE-2000-0129?
To protect against CVE-2000-0129, avoid using the affected Serv-U FTP server with malformed .lnk files and implement proper input validation.
Is there a known exploit for CVE-2000-0129?
Yes, exploits for CVE-2000-0129 have been reported that allow attackers to disrupt service by sending specific malformed requests.