CVE-2008-4247

EUVD-2008-4230
ftpd in OpenBSD 4.3, FreeBSD 7.0, NetBSD 4.0, Solaris, and possibly other operating systems interprets long commands from an FTP client as multiple commands, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and execute arbitrary FTP commands via a long ftp:// URI that leverages an existing session from the FTP client implementation in a web browser.
CSRF
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 UNKNOWN
NETWORK
LOW
AV:N/AC:L/Au:N/C:P/I:P/A:P
Base Score
CVSS 3.x
EPSS Score
Percentile: 93%
Affected Products (NVD)
VendorProductVersion
freebsdfreebsd
7.0
netbsdnetbsd
4.0
openbsdopenbsd
4.3
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
linux-ftpd
bookworm
0.17-37
fixed
bullseye
0.17-36.2
fixed
etch
no-dsa
linux-ftpd-ssl
bookworm
0.17.36+really0.17-2
fixed
bullseye
0.17.36+0.3-2.2
fixed
etch
no-dsa
sid
0.17.36+really0.17-3
fixed
Common Weakness Enumeration
References
ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2008-014.txt.asc
http://bugs.proftpd.org/show_bug.cgi?id=3115
http://secunia.com/advisories/32068
http://secunia.com/advisories/32070
http://secunia.com/advisories/33341
http://security.FreeBSD.org/advisories/FreeBSD-SA-08:12.ftpd.asc
http://securityreason.com/achievement_securityalert/56
http://securityreason.com/securityalert/4313
http://www.openbsd.org/cgi-bin/cvsweb/src/libexec/ftpd/ftpcmd.y
http://www.openbsd.org/cgi-bin/cvsweb/src/libexec/ftpd/ftpcmd.y.diff?r1=1.51&r2=1.52&f=h
http://www.openbsd.org/cgi-bin/cvsweb/src/libexec/ftpd/ftpd.c
http://www.openbsd.org/cgi-bin/cvsweb/src/libexec/ftpd/ftpd.c.diff?r1=1.183&r2=1.184&f=h
http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html
http://www.securitytracker.com/id?1020946
http://www.securitytracker.com/id?1021112
ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2008-014.txt.asc
http://bugs.proftpd.org/show_bug.cgi?id=3115
http://secunia.com/advisories/32068
http://secunia.com/advisories/32070
http://secunia.com/advisories/33341
http://security.FreeBSD.org/advisories/FreeBSD-SA-08:12.ftpd.asc
http://securityreason.com/achievement_securityalert/56
http://securityreason.com/securityalert/4313
http://www.openbsd.org/cgi-bin/cvsweb/src/libexec/ftpd/ftpcmd.y
http://www.openbsd.org/cgi-bin/cvsweb/src/libexec/ftpd/ftpcmd.y.diff?r1=1.51&r2=1.52&f=h
http://www.openbsd.org/cgi-bin/cvsweb/src/libexec/ftpd/ftpd.c
http://www.openbsd.org/cgi-bin/cvsweb/src/libexec/ftpd/ftpd.c.diff?r1=1.183&r2=1.184&f=h
http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html
http://www.securitytracker.com/id?1020946
http://www.securitytracker.com/id?1021112