CVE-1999-1148

Medium

Published: 31/12/1999(UTC)Updated: 16/06/2026(UTC)Translated: 18/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

14.24%

96th percentile - higher than 96% of all known CVEs

Summary

The FTP service in IIS 4.0 and earlier allows remote attackers to cause a denial of service (resource exhaustion) by establishing many simultaneous passive (PASV) connections.

Risk Assessment

Attackers can exploit this vulnerability to overload the server, leading to unavailability of the FTP service for users.

Recommendation

It is recommended to upgrade to a newer version of IIS that is not vulnerable to this issue, and to monitor and limit the number of simultaneous PASV connections.

Original NVD description (English source)

FTP service in IIS 4.0 and earlier allows remote attackers to cause a denial of service (resource exhaustion) via many passive (PASV) connections at the same time.