CWD Root Command Vulnerability

The CWD (Change Working Directory) command is a basic FTP client utility. This vulnerability allows an attacker to gain root access on the server by executing a malicious CWD command.

This is an older FTP client vulnerability, not widely used today. If you use a modern FTP client or have replaced it with a more secure alternative (like SFTP), you're likely not affected. However, if you still use the classic FTP client from 1999, check with your system administrator to see if they are using this specific version.

Version info: CVE-1999-0082 is associated with an older FTP server software, but no exact version range is specified in the advisory.

To fix this vulnerability, you can update your FTP client or replace it with a more secure alternative. You can also apply immediate mitigations:

1. Disable the CWD command: Edit your FTP server configuration to disable the CWD command.
2. Use SFTP instead of FTP: Consider migrating to an SFTP (Secure File Transfer Protocol) client for secure file transfers.

• www.alw.nih.gov
• www.alw.nih.gov