# CVE-1999-0076: Washington University wu-ftpd buffer overflow in PASV command

Source: https://junglewise.ai/threats/cve-1999-0076-washington-university-wu-ftpd-buffer-overflow-in-pasv-command  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 1997-07-01. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-1999-0076 · Severity: medium · CVSS 5 · Published 1997-07-01

A vulnerability exists in the Washington University FTP (wu-ftpd) server, a common tool used for transferring files over a network. An attacker can trigger a crash of the service by sending a specifically crafted command, leading to a denial of service. This prevents legitimate users from accessing or uploading files, potentially disrupting business operations that rely on automated file transfers.

Technologies: [Washington University Wu-Ftpd](https://junglewise.ai/threats/technologies/wu-ftpd). Vendors: [Washington University](https://junglewise.ai/threats/vendors/washington-university).

## Quick answers

**Is CVE-1999-0076 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-1999-0076 being exploited in the wild.

**How severe is CVE-1999-0076?** Medium severity, with a CVSS score of 5, published 1 July 1997.

**Which products and versions are affected?** Washington University wu-ftpd.

**Is there a fix for CVE-1999-0076?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-1999-0076 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-1999-0076?** Check whether you run Washington University Wu-Ftpd. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A buffer overflow vulnerability exists in the PASV command implementation of the wu-ftpd server. The flaw is triggered when the server processes a malformed or unexpected PASV request, leading to memory corruption and a subsequent core dump. This is a remote, unauthenticated attack vector that results in a denial of service (DoS). While the primary impact is service instability, buffer overflows in this era of software often carried risks of arbitrary code execution, though only denial of service is confirmed in this specific advisory. Users should upgrade to a patched version of wu-ftpd or migrate to a more modern FTP daemon.

## Affected products

- Washington University wu-ftpd

## Timeline

- 1997-07-01: disclosed: Initial publication date in NVD

## References

- [https://exchange.xforce.ibmcloud.com/vulnerabilities/CVE-1999-0076](https://exchange.xforce.ibmcloud.com/vulnerabilities/CVE-1999-0076)

## Related threats

- [wu-ftpd and BSDI ftpd race condition in SITE EXEC command](https://junglewise.ai/threats/cve-1999-0955-wu-ftpd-and-bsdi-ftpd-race-condition-in-site-exec-command)
- [Washington University wu-ftpd privilege escalation via ABOR command](https://junglewise.ai/threats/cve-1999-1326-washington-university-wu-ftpd-privilege-escalation-via-abor)
- [Washington University wu-ftpd authentication bypass](https://junglewise.ai/threats/cve-1999-0156-washington-university-wu-ftpd-authentication-bypass)
- [Washington University wu-ftpd file overwrite via rnfr command](https://junglewise.ai/threats/cve-1999-0081-washington-university-wu-ftpd-file-overwrite-via-rnfr-command)
- [Washington University wu-ftpd core dump via PASV command](https://junglewise.ai/threats/cve-1999-0075-washington-university-wu-ftpd-core-dump-via-pasv-command)