Is CVE-1999-1326 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-1999-1326 being exploited in the wild.

How severe is CVE-1999-1326?

Medium severity, with a CVSS score of 5, published 4 July 1997.

Which products and versions are affected?

Washington University wu-ftpd 2.4.

Is there a fix for CVE-1999-1326?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-1999-1326 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-1999-1326?

Check whether you run Washington University Wu-Ftpd. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-1999-1326: Washington University wu-ftpd privilege escalation via ABOR command

CVE-1999-1326 · Severity: medium · CVSS 5 · Published 1997-07-04

wu-ftpd is a widely used file transfer service. A flaw in how it handles interrupted file transfers allows an attacker to trick the server into maintaining administrative (root) privileges. This can be exploited to read sensitive files on the server that should otherwise be protected.

Technologies: Washington University Wu-Ftpd. Vendors: Washington University.

Quick answers

Is CVE-1999-1326 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-1999-1326 being exploited in the wild.
How severe is CVE-1999-1326?: Medium severity, with a CVSS score of 5, published 4 July 1997.
Which products and versions are affected?: Washington University wu-ftpd 2.4.
Is there a fix for CVE-1999-1326?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-1999-1326 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-1999-1326?: Check whether you run Washington University Wu-Ftpd. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A race condition exists in wu-ftpd 2.4 involving signal handling during file transfers. When a user aborts a transfer, the server may receive both a SIGPIPE (from a closed data connection) and a SIGURG (from an ABOR command). The SIGPIPE handler elevates privileges to root (uid 0) to perform cleanup tasks like updating log files. If a SIGURG is handled via longjmp() while the server is in this elevated state, it returns to the main command loop without dropping privileges. An attacker can then execute commands with root authority, such as reading any file on the filesystem. The vulnerability is mitigated by ensuring signals are suspended during privilege elevation or by resetting the transfer flag before cleanup.

Affected products

Washington University wu-ftpd 2.4

Timeline

1997-01-02: disclosed: Initial discovery and report by David Greenman
1997-01-04: advisory: Public disclosure on Bugtraq by Aleph One
1997-07-04: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.