CVE-1999-0997

2000-04-2504:00:00

[email protected]

web.nvd.nist.gov

cve-1999-0997

wu-ftp

ftp conversion

command execution vulnerability

nvd

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

6.6 Medium

AI Score

Confidence

Low

0.125 Low

EPSS

Percentile

95.5%

JSON

wu-ftp with FTP conversion enabled allows an attacker to execute commands via a malformed file name that is interpreted as an argument to the program that does the conversion, e.g. tar or uncompress.

Affected configurations

NVD

Node

millenux_gmbhanonftpMatch2.8.1

university_of_washingtonwu-ftpdMatch2.4.2

university_of_washingtonwu-ftpdMatch2.5.0

university_of_washingtonwu-ftpdMatch2.6.0

Node

redhatlinuxMatch5.2

redhatlinuxMatch6.0

redhatlinuxMatch6.1

CPENameOperatorVersion
millenux_gmbh:anonftpmillenux gmbh anonftpeq2.8.1
university_of_washington:wu-ftpduniversity of washington wu-ftpdeq2.4.2
university_of_washington:wu-ftpduniversity of washington wu-ftpdeq2.5.0
university_of_washington:wu-ftpduniversity of washington wu-ftpdeq2.6.0

CPE	Name	Operator	Version
millenux_gmbh:anonftp	millenux gmbh anonftp	eq	2.8.1
university_of_washington:wu-ftpd	university of washington wu-ftpd	eq	2.4.2
university_of_washington:wu-ftpd	university of washington wu-ftpd	eq	2.5.0
university_of_washington:wu-ftpd	university of washington wu-ftpd	eq	2.6.0