CVE-1999-1333: automatic download option in ncftp 2.4.2 FTP client in Red Hat Linux 5.0 and earlier allows remote attacker...

Security readout for executives and security teams

An old ncftp FTP client feature could turn a downloaded filename into shell command execution. If a user or automated job used vulnerable ncftp 2.4.2 on Red Hat Linux 5.0 or earlier against malicious FTP content, attacker-controlled filenames could run commands on that client. This is mainly legacy-system risk. Likely limited to legacy systems running Red Hat Linux 5.0 or earlier with ncftp 2.4.2 and automatic downloads. Exposure requires client interaction with attacker-controlled FTP content. Modern systems are only in scope if they retain this old client or inherited automation. Prioritize if legacy Red Hat or FTP automation remains in production or sensitive environments. For most modern environments, urgency is lower, but unmanaged legacy hosts can convert a simple file-transfer workflow into client-side command execution. Mitigation focus: Inventory systems and scripts using ncftp, especially legacy Red Hat Linux hosts.; Disable automatic FTP downloads where ncftp 2.4.2 is present.; Replace ncftp 2.4.2 with a vendor-supported FTP client or maintained package..

Prepared

Jul 1, 2026, 08:03 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.