PT-1999-1654 · Ncftp · Ncftp

Publicado 1999-12-31 · Atualizado 2016-10-18 · CVE-1999-1333

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: ncftp versions 2.4.2 and earlier

Description: The issue concerns the automatic download option in the ncftp FTP client, which allows remote attackers to execute arbitrary commands via shell metacharacters in the names of files that are to be downloaded.

Recommendations: For ncftp version 2.4.2 and earlier, consider disabling the automatic download option to prevent exploitation until a patch is available. Restrict access to the FTP client to minimize the risk of exploitation. Avoid using the automatic download feature for files from untrusted sources.

Correção

Identificadores relacionados

CVE-1999-1333

Produtos afetados

Ncftp

Referências · 5

• http://redhat.com/support/errata/rh50-errata-general.html#ncftp · Nota
• http://osvdb.org/6111 · Nota
• http://iss.net/security_center/static/7240.php · Nota
• http://marc.info/?l=bugtraq&m=89042322924057&w=2 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-1999-1333 · Nota de Segurança