PT-1999-1745 · Bisonware · Bisonware Ftp Server

Published 1999-05-17 · Updated 2017-12-19 · CVE-1999-1510

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Bisonware FTP server versions prior to 4.1

Description: The issue concerns buffer overflows that can be triggered by remote attackers sending long commands, specifically the (1) USER, (2) LIST, or (3) CWD commands. This can lead to a denial of service and potentially allow the execution of arbitrary commands.

Recommendations: For versions prior to 4.1, update to version 4.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the Bisonware FTP server until the update can be applied. Avoid using long commands in the affected API endpoints, such as the USER, LIST, or CWD commands, until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-1999-1510

Affected Products

Bisonware Ftp Server

References · 7

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/ftp/bison_ftp_bof.rb · Exploit
• 🔥 https://exploit-db.com/exploits/17810 · Exploit
• 🔥 https://exploit-db.com/exploits/17649 · Exploit
• 🔥 https://exploit-db.com/exploits/19219 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-1999-1510 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/3234 · Note
• http://marc.info/?l=ntbugtraq&m=92697301706956&w=2 · Note