| Vulnerability Name: | CVE-2008-4247 (CCN-45434) | ||||||||
| Assigned: | 2008-09-20 | ||||||||
| Published: | 2008-09-20 | ||||||||
| Updated: | 2012-10-23 | ||||||||
| Summary: | ftpd in OpenBSD 4.3, FreeBSD 7.0, NetBSD 4.0, Solaris, and possibly other operating systems interprets long commands from an FTP client as multiple commands, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and execute arbitrary FTP commands via a long ftp:// URI that leverages an existing session from the FTP client implementation in a web browser. | ||||||||
| CVSS v3 Severity: | 5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
| ||||||||
| CVSS v2 Severity: | 7.5 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P) 6.5 Medium (Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P/E:H/RL:OF/RC:C)
3.7 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:H/RL:OF/RC:C)
| ||||||||
| Vulnerability Type: | CWE-352 | ||||||||
| Vulnerability Consequences: | Gain Access | ||||||||
| References: | Source: NETBSD Type: UNKNOWN NetBSD-SA2008-014 Source: CCN Type: Bugzilla Bug 3115 Cross-site request forgery Source: MISC Type: UNKNOWN http://bugs.proftpd.org/show_bug.cgi?id=3115 Source: MITRE Type: CNA CVE-2008-4247 Source: CCN Type: SA32068 NetBSD ftpd Long Command Processing Vulnerability Source: SECUNIA Type: UNKNOWN 32068 Source: CCN Type: SA32070 OpenBSD ftpd Long Command Processing Vulnerability Source: SECUNIA Type: UNKNOWN 32070 Source: CCN Type: SA33341 FreeBSD ftpd Long Command Processing Vulnerability Source: SECUNIA Type: UNKNOWN 33341 Source: CCN Type: SA39856 Sun Solaris FTP Server Long Command Processing Vulnerability Source: CCN Type: FreeBSD-SA-08:12.ftpd Cross-site request forgery in ftpd(8) Source: FREEBSD Type: UNKNOWN FreeBSD-SA-08:12 Source: CCN Type: FreeBSD-SA-09:01.lukemftpd Cross-site request forgery in lukemftpd(8) Source: CCN Type: SecurityReason Advisory: SecurityAlert : 56 SecurityReason - multiple vendor ftpd - Cross-site request forgery ( Research Advisory ) Source: SREASONRES Type: UNKNOWN 20080926 multiple vendor ftpd - Cross-site request forgery Source: CCN Type: SecurityReason SecurityAlert : 84 Sun Solaris 10 ftpd Cross-site request forgery Source: SREASON Type: UNKNOWN 4313 Source: CCN Type: SECTRACK ID: 1020946 BSD ftpd Request Processing Bug Permits Cross-Site Request Forgery Attacks Source: CCN Type: SECTRACK ID: 1021112 NetBSD ftpd Request Processing Bug Permits Cross-Site Request Forgery Attacks Source: CCN Type: SourceForge.net: Files smbftpd, File Release Notes and Changelog, Release Name: 2.2 Source: CCN Type: FreeBSD Web site The FreeBSD Project Source: CCN Type: NetBSD Web site Announcing NetBSD 4.0 Source: CONFIRM Type: UNKNOWN http://www.openbsd.org/cgi-bin/cvsweb/src/libexec/ftpd/ftpcmd.y Source: CONFIRM Type: Exploit http://www.openbsd.org/cgi-bin/cvsweb/src/libexec/ftpd/ftpcmd.y.diff?r1=1.51&r2=1.52&f=h Source: CONFIRM Type: UNKNOWN http://www.openbsd.org/cgi-bin/cvsweb/src/libexec/ftpd/ftpd.c Source: CONFIRM Type: Exploit http://www.openbsd.org/cgi-bin/cvsweb/src/libexec/ftpd/ftpd.c.diff?r1=1.183&r2=1.184&f=h Source: CCN Type: OpenBSD Web site Manual Pages: ftpd Source: CCN Type: Sun Web site Sun Solaris Source: CCN Type: Oracle Critical Patch Update Advisory - July 2010 Oracle Critical Patch Update Advisory - July 2010 Source: CONFIRM Type: UNKNOWN http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html Source: CCN Type: OSVDB ID: 48612 OpenBSD ftpd FTP Command Handling CSRF Source: CCN Type: OSVDB ID: 48616 NetBSD ftpd FTP Command Handling CSRF Source: CCN Type: OSVDB ID: 50963 FreeBSD ftpd / lukemftpd FTP Command Handling CSRF Source: CCN Type: OSVDB ID: 51371 tnftpd FTP Command Handling CSRF Source: CCN Type: OSVDB ID: 64869 Solaris FTP Server Long Command Processing CSRF Source: SECTRACK Type: UNKNOWN 1020946 Source: SECTRACK Type: UNKNOWN 1021112 Source: XF Type: UNKNOWN bsd-ftpd-csrf(45434) | ||||||||
| Vulnerable Configuration: | Configuration 1: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||
| BACK | |||||||||