CVE-1999-0080

CVE-1999-0080 affects wu-ftp FTP server 2.4 where PATH_EXECPATH can point to a directory with dangerous commands (e.g., /bin). This misconfiguration allows remote authenticated users to gain root access via the SITE EXEC command. Remediation: upgrade to Wu-FTPD 2.4 or later or adjust PATH EXECPAT...

CVE-1999-0185

The CVE-1999-0185 entry concerns SunOS/Solaris where a remote user could leverage an FTP server’s data port to connect to an rlogin server on a host that trusts the FTP server, enabling remote command execution. The vulnerability arises from an insecure trust relationship between the FTP data pat...

ProFTPD NLST Command Argument Handling Remote Overflow

It was possible to crash the remote FTP server by issuing a specially crafted command, such as 'NLST aaaXXXX%u%...%u%u%u%%u%653300u%n' where 'XXXX' is replaced with four characters - ASCII values 0xDC, 0x4F, 0x07 and 0x08. This issue is known to affect ProFTPD version 1.2.0pre6, although other FT...

WU-FTPD Multiple Vulnerabilities (OF, Priv Esc)

It was possible to make the remote FTP server crash by creating a huge directory structure. This is usually called the 'wu-ftpd buffer overflow' even though it affects other FTP servers. An attacker can exploit this issue to crash the FTP server, or execute arbitrary code. C Tenable Network...

ncftpd.2.txt

Date: Tue, 23 Feb 1999 14:59:14 -0400 From: Julien Nadeau To: [email protected] Subject: NcFTPd remote buffer overflow Proof of Concept - Security Advisory 02/23/99 http://poc.csoft.net Released by [email protected] [email protected] --- Affected Program NcFTPd Description FTP server...

ncftpd.txt

Proof of Concept - Security Advisory 02/16/99 http://poc.csoft.net Released by [email protected] [email protected] --- Affected Program NcFTPd Description FTP server commercial Severity Can port anywhere / spoof Synopsis: NcFTPd is a commercial FTP File Transfer Protocol server, in the NcFTP produc...

bisonware.ftp.txt

Date: Mon, 17 May 1999 12:52:02 -0400 From: Russ To: [email protected] Subject: Vulnerabilities in BisonWare FTP Server 3.5 Arne Vidstrom submitted the following observations regarding BisonWare FTP Server 3.5. I contacted the authors of BisonWare and gave them a copy of Arne's...

trojan-backdoor-ftp.win.tue.nl.txt

Date: Sun, 24 Jan 1999 09:03:42 -0500 From: Trevor Johnson To: [email protected] Subject: Re: util-linux compromised I just received the following letter: Date: Sun, 24 Jan 1999 04:01:55 -0500 EST From: John Stange Subject: util-linux compromised? I grabbed util-linux-2.9g yesterday from...

broker.ftp.server.3.0.txt

Date: Tue, 1 Jun 1999 07:24:24 +0200 From: Arne Vidstrom To: [email protected] Subject: Vulnerability in Broker FTP Server v. 3.0 Build 1 Hi, I've found a vulnerability in Broker FTP Server v. 3.0 Build 1. Here's an example: You have it installed with FTP root in c:\FTProot and you...

ftpd.txt

------------------------------------------------------------------------- Netect, Inc. General Public Security Advisory % Advisory: palmetto.ftpd % Issue date: February 9, 1999 % Revision: February 8, 1999 % Contact: Jordan Ritter Topic Remote buffer overflows in various FTP servers leads to...

Windows NT FTP 'guest' Account Present

The remote Windows host has a 'guest' FTP account enabled. This could allow a remote attacker to upload or download arbitrary files on the remote host. Note that this plugin only tests for guest accounts over FTP. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid10166;...

Multiple FTP Server QUOTE CWD Command Home Path Disclosure

It is possible to determine the full path of the home directory of the 'ftp' user by issuing the 'CWD' command. An attacker can exploit this to determine where to put a .rhost file using other security flaws. C Tenable Network Security, Inc. include"compat.inc"; ifdescription scriptid10087;...

Linux FTP Server Backdoor Detection

There is a backdoor in the old FTP daemons of Linux that allows remote users to log in as 'NULL' with password 'NULL'. These credentials provide root access. C Tenable Network Security, Inc. include"compat.inc"; ifdescription scriptid10080; scriptversion "1.27"; scriptcvsdate"Date: 2018/06/13...

FTP Privileged Port Bounce Scan

It is possible to force the remote FTP server to connect to third parties using the PORT command. The problem allows intruders to use your network resources to scan other hosts, making them think the attack comes from your network. TRUSTED...

Microsoft IIS FTP Server NLST Command Overflow DoS

It is possible to make the IIS FTP server close all the active connections by issuing a too long NLST command, which will make the server crash. An attacker can use this flaw to prevent people from downloading data from your FTP server. C Tenable Network Security, Inc. include"compat.inc";...

Serv-U CWD Command Overflow

The remote FTP server is affected by a buffer overflow vulnerability. A remote, authenticated user can cause a denial of service via a long 'CWD' or 'LS' command. An attacker could exploit this to crash the affected host. C Tenable Network Security, Inc. include"compat.inc"; if description...

TYPSoft FTP Server 0.7.x - FTP Server Remote Denial of Service

source: https://www.securityfocus.com/bid/1690/info Long commands ie., over 2048 bytes sent to TYPSoft FTP Server cab cause the server to hang, requiring a manual restart to restore the process. After the release of this advisory Noam Rathaus from http://www.BeyondSecurity.com contributed the...

TYPSoft FTP Server 0.7.x - FTP Server Remote Denial of Service

TYPSoft FTP Server 0.7.x - FTP Server Remote Denial of Service source: https://www.securityfocus.com/bid/1690/info Long commands ie., over 2048 bytes sent to TYPSoft FTP Server cab cause the server to hang, requiring a manual restart to restore the process. After the release of this advisory Noam...

CVE-1999-1510

Buffer overflows in Bisonware FTP server prior to 4.1 allow remote attackers to cause a denial of service, and possibly execute arbitrary commands, via long 1 USER, 2 LIST, or 3 CWD commands...

CVE-1999-1156

BisonWare FTP Server 4.1 and earlier allows remote attackers to cause a denial of service via a malformed PORT command that contains a non-numeric character and a large number of carriage returns...