PT-1999-1654 · Ncftp · Ncftp

Published 1999-12-31 · Updated 2016-10-18 · CVE-1999-1333

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: ncftp versions 2.4.2 and earlier

Description: The issue concerns the automatic download option in the ncftp FTP client, which allows remote attackers to execute arbitrary commands via shell metacharacters in the names of files that are to be downloaded.

Recommendations: For ncftp version 2.4.2 and earlier, consider disabling the automatic download option to prevent exploitation until a patch is available. Restrict access to the FTP client to minimize the risk of exploitation. Avoid using the automatic download feature for files from untrusted sources.

Fix

Related Identifiers

CVE-1999-1333

Affected Products

Ncftp

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-1999-1333 · Security Note
• http://redhat.com/support/errata/rh50-errata-general.html#ncftp · Note
• http://osvdb.org/6111 · Note
• http://iss.net/security_center/static/7240.php · Note
• http://marc.info/?l=bugtraq&m=89042322924057&w=2 · Note