# CVE-1999-0075: Washington University wu-ftpd core dump via PASV command

Source: https://junglewise.ai/threats/cve-1999-0075-washington-university-wu-ftpd-core-dump-via-pasv-command  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 1996-10-16. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-1999-0075 · Severity: medium · CVSS 5 · Published 1996-10-16

A vulnerability exists in the wu-ftpd software, a common tool used for transferring files between computers. An attacker can cause the file transfer service to crash or behave unexpectedly by sending a specific command after logging in. This can disrupt file transfer operations and potentially impact the availability of the server for legitimate users.

Technologies: [Washington University Wu-Ftpd](https://junglewise.ai/threats/technologies/wu-ftpd). Vendors: [Washington University](https://junglewise.ai/threats/vendors/washington-university).

## Quick answers

**Is CVE-1999-0075 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-1999-0075 being exploited in the wild.

**How severe is CVE-1999-0075?** Medium severity, with a CVSS score of 5, published 16 October 1996.

**Which products and versions are affected?** Washington University wu-ftpd.

**Is there a fix for CVE-1999-0075?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-1999-0075 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-1999-0075?** Check whether you run Washington University Wu-Ftpd. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The wu-ftpd daemon contains a vulnerability that leads to a core dump when processing the PASV (passive mode) command. An attacker must first authenticate with a valid username and password before issuing a 'QUOTE PASV' command to trigger the flaw. This issue is categorized as a denial-of-service or unexpected termination vulnerability within the FTP service handling. The vulnerability was first identified in 1996 and affects early versions of the Washington University FTP daemon.

## Affected products

- Washington University wu-ftpd

## Timeline

- 1996-10-16: disclosed: NVD Published Date

## References

- [http://www.osvdb.org/5742](http://www.osvdb.org/5742)

## Related threats

- [wu-ftpd and BSDI ftpd race condition in SITE EXEC command](https://junglewise.ai/threats/cve-1999-0955-wu-ftpd-and-bsdi-ftpd-race-condition-in-site-exec-command)
- [Washington University wu-ftpd privilege escalation via ABOR command](https://junglewise.ai/threats/cve-1999-1326-washington-university-wu-ftpd-privilege-escalation-via-abor)
- [Washington University wu-ftpd authentication bypass](https://junglewise.ai/threats/cve-1999-0156-washington-university-wu-ftpd-authentication-bypass)
- [Washington University wu-ftpd buffer overflow in PASV command](https://junglewise.ai/threats/cve-1999-0076-washington-university-wu-ftpd-buffer-overflow-in-pasv-command)
- [Washington University wu-ftpd file overwrite via rnfr command](https://junglewise.ai/threats/cve-1999-0081-washington-university-wu-ftpd-file-overwrite-via-rnfr-command)