CVE-1999-0997 Command injection in n/a
Attackers can execute arbitrary commands on wu-ftp servers with conversion enabled by sending malformed filenames, requiring immediate patching.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-1999-0997?
CVE-1999-0997 is a high-severity command injection vulnerability in Redhat Linux, published on 25 Apr 2000. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
wu-ftp with FTP conversion enabled allows an attacker to execute commands via a malformed file name that is interpreted as an argument to the program that does the conversion, e.g. tar or uncompress.
Which versions are affected by CVE-1999-0997?
It affects 3 products.
Products include Millenux Gmbh Anonftp, Redhat Linux, University of Washington Wu-Ftpd.
How do I fix CVE-1999-0997?
Apply the vendor's patch.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-1999-0997 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-1999-0997 exists.
Public exploit code: 1 Exploit-DB entry.
Sources
Also known as DSA-377, GHSA-2hff-p384-25wq.