{"id":"CVE-2001-0550","published":"2002-06-25T04:00:00Z","modified":"2024-08-08T04:21:38Z","title":"wu-ftpd 2.6.1 allows remote attackers to execute arbitrary commands via a \"~{\" argument to commands such as CWD, which…","vendor":null,"product":null,"tier":"core","eol":null,"description":{"text":"wu-ftpd 2.6.1 allows remote attackers to execute arbitrary commands via a \"~{\" argument to commands such as CWD, which is not properly handled by the glob function (ftpglob).","provenance":"source","from":"CVE.org"},"summary":{"text":"The flaw is in wu-ftpd 2.6.1, specifically in its glob handling (the ftpglob function). An attacker who can reach the FTP service can send a \"~{\" argument to commands such as CWD, which is not properly handled and leads to arbitrary command execution.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:15:49Z"},"cvss":null,"epss":{"score":0.74071,"percentile":0.99483,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2017-06-20","exploitedFirstSeen":"2017-06-20","ransomware":false,"evidence":[{"url":"https://community.broadcom.com/symantecenterprise/communities/community-home/librarydocuments/viewdocument?DocumentKey=a9c54f79-d780-437b-a7f5-a74960e299d5&CommunityKey=8af7f28f-02f1-4107-8639-93a60b6546d4&tab=librarydocuments","date":"2017-06-20"}],"evidenceTotal":1,"provenance":"source"},"exploited":true,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[],"references":[{"url":"http://www.novell.com/linux/security/advisories/2001_043_wuftpd_txt.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"http://marc.info/?l=bugtraq&m=100700363414799&w=2","tags":["mailing-list","x_refsource_BUGTRAQ"]},{"url":"http://www.cert.org/advisories/CA-2001-33.html","tags":["third-party-advisory","x_refsource_CERT"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/7611","tags":["vdb-entry","x_refsource_XF"]},{"url":"http://www.linux-mandrake.com/en/security/2001/MDKSA-2001-090.php3","tags":["vendor-advisory","x_refsource_MANDRAKE"]},{"url":"http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000442","tags":["vendor-advisory","x_refsource_CONECTIVA"]},{"url":"http://www1.itrc.hp.com/service/cki/docDisplay.do?docId=HPSBUX0107-162","tags":["vendor-advisory","x_refsource_HP"]},{"url":"http://www.securityfocus.com/archive/82/180823","tags":["mailing-list","x_refsource_VULN-DEV"]},{"url":"http://www.caldera.com/support/security/advisories/CSSA-2001-041.0.txt","tags":["vendor-advisory","x_refsource_CALDERA"]},{"url":"http://www.debian.org/security/2001/dsa-087","tags":["vendor-advisory","x_refsource_DEBIAN"]},{"url":"http://download.immunix.org/ImmunixOS/7.0/updates/IMNX-2001-70-036-01","tags":["vendor-advisory","x_refsource_IMMUNIX"]},{"url":"http://www.redhat.com/support/errata/RHSA-2001-157.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://www.kb.cert.org/vuls/id/886083","tags":["third-party-advisory","x_refsource_CERT-VN"]},{"url":"http://www.securityfocus.com/bid/3581","tags":["vdb-entry","x_refsource_BID"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Remote unauthenticated attacker exploits exposed FTP service input","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"allows remote attackers to execute arbitrary commands via a","start":14,"end":73}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Arbitrary command execution on the server","mappingType":"primary_impact","evidence":[{"from":"description","quote":"allows remote attackers to execute arbitrary commands","start":14,"end":67}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[{"id":"SRC-897604102de47edca361","title":"Get a Handle on cd00r: The Invisible Backdoor","publisher":"giac.org","url":"https://www.giac.org/paper/gcih/342/handle-cd00r-invisible-backdoor/103631","date":null,"mentions":[{"quote":"xiii Wu-Ftpd File Globbing Heap Corruption Vulnerability CVE -2001 -0550.","start":128508,"end":128581}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2001-0542","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2001-0542","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[{"id":348,"url":"https://www.exploit-db.com/exploits/348","title":"WU-FTPD 2.6.1 - Remote Command Execution","type":"remote","platform":"linux","date":"2002-05-14","verified":true,"provenance":"source"},{"id":21161,"url":"https://www.exploit-db.com/exploits/21161","title":"WU-FTPD 2.6 - File Globbing Heap Corruption","type":"remote","platform":"unix","date":"2001-11-27","verified":true,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":2,"earliest":"2001-11-27"},"pocGithub":{"count":1,"skipped":0,"earliest":"2022-07-28","earliestUrl":"https://github.com/gilberto47831/Network-Filesystem-Forensics","repos":[{"name":"gilberto47831/Network-Filesystem-Forensics","url":"https://github.com/gilberto47831/Network-Filesystem-Forensics","stars":0,"created":"2022-07-28"}]},"first":{"date":"2001-11-27","source":"Exploit-DB","url":"https://www.exploit-db.com/exploits/21161"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1059"],"provenance":"ai"}],"timeline":[{"date":"2001-11-27","kind":"exploit-public","label":"First public exploit: Exploit-DB (EDB-21161); later: PoC-in-GitHub 2022-07-28","url":"https://www.exploit-db.com/exploits/21161","provenance":"source"},{"date":"2002-06-25","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2001-0550","provenance":"source"},{"date":"2017-06-20","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://community.broadcom.com/symantecenterprise/communities/community-home/librarydocuments/viewdocument?DocumentKey=a9c54f79-d780-437b-a7f5-a74960e299d5&CommunityKey=8af7f28f-02f1-4107-8639-93a60b6546d4&tab=librarydocuments","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Exploit-DB","daysToKev":null},"priority":{"score":63.8,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 3420 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.9,"detail":"percentile 0.9948"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":5.0,"detail":"2 Exploit-DB entries; 1 PoC-in-GitHub repo"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}