CVE-1999-0017
published 1997-12-10CVE-1999-0017: FTP servers can allow an attacker to connect to arbitrary ports on machines other than the FTP client, aka FTP bounce.
PriorityP422high7.5CVSS 2.0
AVNACLAuNCPIPAP
EPSS
1.98%
80.4th percentile
FTP servers can allow an attacker to connect to arbitrary ports on machines other than the FTP client, aka FTP bounce.
Affected
36 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| bluearc | titan | <= 4.2.944b | — |
| bluearc | titan | — | — |
| bluearc | titan | — | — |
| bluearc | titan | — | — |
| caldera | openlinux | — | — |
| debian | python-pyftpdlib | — | — |
| freebsd | freebsd | — | — |
| freebsd | freebsd | — | — |
| freebsd | freebsd | — | — |
| freebsd | freebsd | — | — |
| freebsd | freebsd | — | — |
| freebsd | freebsd | — | — |
| g.rodola | pyftpdlib | <= 0.1.1 | — |
| g.rodola | pyftpdlib | — | — |
| g.rodola | pyftpdlib | >= 0 < 0.2.0 | 0.2.0 |
| gnu | inet | — | — |
| gnu | inet | — | — |
| gnu | inet | — | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
| netbsd | netbsd | — | — |
| netbsd | netbsd | — | — |
| netbsd | netbsd | — | — |
CVSS provenance
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
ghsa7.5HIGH
osv7.5HIGH
vendor_debian7.5LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-m8v7-79j6-gf3v: BlueArc-FTPD in BlueArc Titan 2x00 devices with firmware 4
ghsa_unreviewed·2022-05-01·CVSS 7.5
CVE-2007-2150 [HIGH] GHSA-m8v7-79j6-gf3v: BlueArc-FTPD in BlueArc Titan 2x00 devices with firmware 4
BlueArc-FTPD in BlueArc Titan 2x00 devices with firmware 4.2.944b allows remote attackers to redirect traffic to other sites (aka FTP bounce) via the PORT command, a variant of CVE-1999-0017.
GHSA
Improper privilege management in pyftpdlib
ghsa·2022-05-01·CVSS 7.5
CVE-2007-6741 [HIGH] CWE-269 Improper privilege management in pyftpdlib
Improper privilege management in pyftpdlib
The ftp_PORT function in FTPServer.py in pyftpdlib before 0.2.0 does not prevent TCP connections to privileged ports if the destination IP address matches the source IP address of the connection from the FTP client, which might allow remote authenticated users to conduct FTP bounce attacks via crafted FTP data, as demonstrated by an FTP bounce attack against a NAT server, a related issue to CVE-1999-0017.
GHSA
GHSA-2fmr-xm36-8jjg: The FTP server in the NEC MultiWriter 1700C allows remote attackers to redirect traffic to other sites (aka FTP bounce) via the PORT command, a varian
ghsa_unreviewed·2022-05-01·CVSS 7.5
CVE-2006-6947 [HIGH] GHSA-2fmr-xm36-8jjg: The FTP server in the NEC MultiWriter 1700C allows remote attackers to redirect traffic to other sites (aka FTP bounce) via the PORT command, a varian
The FTP server in the NEC MultiWriter 1700C allows remote attackers to redirect traffic to other sites (aka FTP bounce) via the PORT command, a variant of CVE-1999-0017.
OSV
Improper privilege management in pyftpdlib
osv·2022-05-01·CVSS 7.5
CVE-2007-6741 [HIGH] Improper privilege management in pyftpdlib
Improper privilege management in pyftpdlib
The ftp_PORT function in FTPServer.py in pyftpdlib before 0.2.0 does not prevent TCP connections to privileged ports if the destination IP address matches the source IP address of the connection from the FTP client, which might allow remote authenticated users to conduct FTP bounce attacks via crafted FTP data, as demonstrated by an FTP bounce attack against a NAT server, a related issue to CVE-1999-0017.
GHSA
GHSA-mq66-4xx4-r348: FTP servers can allow an attacker to connect to arbitrary ports on machines other than the FTP client, aka FTP bounce
ghsa_unreviewed·2022-04-30
CVE-1999-0017 [HIGH] GHSA-mq66-4xx4-r348: FTP servers can allow an attacker to connect to arbitrary ports on machines other than the FTP client, aka FTP bounce
FTP servers can allow an attacker to connect to arbitrary ports on machines other than the FTP client, aka FTP bounce.
OSV
CVE-2007-6741: The ftp_PORT function in FTPServer
osv·2010-10-19·CVSS 7.5
CVE-2007-6741 [HIGH] CVE-2007-6741: The ftp_PORT function in FTPServer
The ftp_PORT function in FTPServer.py in pyftpdlib before 0.2.0 does not prevent TCP connections to privileged ports if the destination IP address matches the source IP address of the connection from the FTP client, which might allow remote authenticated users to conduct FTP bounce attacks via crafted FTP data, as demonstrated by an FTP bounce attack against a NAT server, a related issue to CVE-1999-0017.
Debian
CVE-2007-6741: python-pyftpdlib - The ftp_PORT function in FTPServer.py in pyftpdlib before 0.2.0 does not prevent...
vendor_debian·2007·CVSS 7.5
CVE-2007-6741 [HIGH] CVE-2007-6741: python-pyftpdlib - The ftp_PORT function in FTPServer.py in pyftpdlib before 0.2.0 does not prevent...
The ftp_PORT function in FTPServer.py in pyftpdlib before 0.2.0 does not prevent TCP connections to privileged ports if the destination IP address matches the source IP address of the connection from the FTP client, which might allow remote authenticated users to conduct FTP bounce attacks via crafted FTP data, as demonstrated by an FTP bounce attack against a NAT server, a related issue to CVE-1999-0017.
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved
sid: resolved
trixie: resolved
No detection rules found.
No writeups or analysis indexed.
1997-12-10
Published