CVE-2008-4247 ftpd in OpenBSD 4.3, FreeBSD 7.0, NetBSD 4.0, Solaris, and possibly other operating systems interprets long commands from an FTP client as multiple commands, which allows remote attackers to conduct c...
HighCVSS 7.5
EPSS 5.3%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
ftpd in OpenBSD 4.3, FreeBSD 7.0, NetBSD 4.0, Solaris, and possibly other operating systems interprets long commands from an FTP client as multiple commands, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and execute arbitrary FTP commands via a long ftp:// URI that leverages an existing session from the FTP client implementation in a web browser.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| freebsd | = 7.0 | No fix listed |
| netbsd | = 4.0 | No fix listed |
| OpenBSD | = 4.3 | No fix listed |
| debian/linux-ftpd(Debian:12) | < 0.17-29 | 0.17-29 |
| debian/linux-ftpd-ssl(Debian:12) | < 0.17.27+0.3-3 | 0.17.27+0.3-3 |
References
- bugs.proftpd.org
- 32068 third-party-advisory
- 32070 third-party-advisory
- 33341 third-party-advisory
- FreeBSD-SA-08:12 vendor-advisory
- 20080926 multiple vendor ftpd - Cross-site request forgery third-party-advisory
- 4313 third-party-advisory
- www.openbsd.org
- www.openbsd.org exploit
- www.openbsd.org
- www.openbsd.org exploit
- www.oracle.com
- 1020946 vdb-entry
- 1021112 vdb-entry
- Debian Security Tracker CVE-2008-4247 vendor-advisory
- bugs.debian.org issue-tracking
- bugs.debian.org issue-tracking