PT-1995-1003 · Washington University · Wu-Ftp Ftp Server

Published 1995-11-30 · Updated 2022-08-17 · CVE-1999-0080

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions wu-ftp FTP server version 2.4

Description The issue concerns certain configurations of the wu-ftp FTP server that use a PATH EXECPATH setting to a directory with dangerous commands, such as /bin. This configuration allows remote authenticated users to gain root access via the "site exec" command.

Recommendations For wu-ftp FTP server version 2.4, consider changing the PATH EXECPATH setting to a directory without dangerous commands to prevent remote authenticated users from gaining root access. As a temporary workaround, restrict access to the "site exec" command until a more permanent solution is implemented.

Fix

Related Identifiers

CVE-1999-0080

Affected Products

Wu-Ftp Ftp Server

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-1999-0080 · Security Note
• https://archive.nanog.org/mailinglist/mailarchives/old_archive/1995-11/msg00385.html · Note