CVE-1999-1119

Step 1: Reconnaissance: The attacker identifies a target AIX system with an open FTP port (port 21).

Step 2: Anonymous Login: The attacker attempts to connect to the FTP server using the anonymous credentials (username: anonymous, password: user@example.com or similar).

Step 3: Command Injection: The attacker crafts a malicious command, potentially using the SITE command or other FTP commands that are then executed on the server.

Step 4: Command Execution: The vulnerable anon.ftp script, due to its insecure configuration, executes the attacker's injected command with elevated privileges.

Step 5: System Compromise: The attacker gains control of the system, potentially installing backdoors, stealing data, or disrupting services.

The vulnerability stems from the anon.ftp script's insecure configuration of the anonymous FTP service. Specifically, the script likely fails to properly sanitize or restrict commands executed within the FTP environment. This allows attackers to inject malicious commands, potentially through the SITE command or other FTP commands that are then executed with elevated privileges. The root cause is a lack of input validation and secure configuration practices during the setup of the anonymous FTP service. The script likely grants excessive permissions to the anonymous FTP user, allowing them to execute commands that should be restricted.