CVE-2014-8517 The fetch_url function in usr.bin/ftp/fetch.c in tnftp, as used in NetBSD 5.1 through 5.1.4, 5.2 through 5.2.2, 6.0 through 6.0.6, and 6.1 through 6.1.5 allows remote attackers to execute arbitrary co...
HighCVSS 7.5
EPSS 69.1%
Framework module
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
The fetch_url function in usr.bin/ftp/fetch.c in tnftp, as used in NetBSD 5.1 through 5.1.4, 5.2 through 5.2.2, 6.0 through 6.0.6, and 6.1 through 6.1.5 allows remote attackers to execute arbitrary commands via a | (pipe) character at the end of an HTTP redirect.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/tnftp(Debian:12) | < 20130505-2 | 20130505-2 |
| debian/tnftp(Debian:13) | < 20130505-2 | 20130505-2 |
| debian/tnftp(Debian:14) | < 20130505-2 | 20130505-2 |
| apple mac os x | = 10.8.5 | No fix listed |
| apple mac os x | = 10.9.5 | No fix listed |
| apple mac os x | = 10.10.0 | No fix listed |
| apple mac os x | = 10.10.1 | No fix listed |
| netbsd | = 5.1 | No fix listed |
| netbsd | = 5.1.1 | No fix listed |
| netbsd | = 5.1.2 | No fix listed |
| netbsd | = 5.1.3 | No fix listed |
| netbsd | = 5.1.4 | No fix listed |
| netbsd | = 5.2 | No fix listed |
| netbsd | = 5.2.1 | No fix listed |
| netbsd | = 5.2.2 | No fix listed |
| netbsd | = 6.0 | No fix listed |
| netbsd | = 6.0.1 | No fix listed |
| netbsd | = 6.0.2 | No fix listed |
| netbsd | = 6.0.3 | No fix listed |
| netbsd | = 6.0.4 | No fix listed |
| netbsd | = 6.0.5 | No fix listed |
| netbsd | = 6.0.6 | No fix listed |
| netbsd | = 6.1 | No fix listed |
| netbsd | = 6.1.1 | No fix listed |
| netbsd | = 6.1.2 | No fix listed |
Show 3 more
| Product | Affected versions | Fixed in |
|---|---|---|
| netbsd | = 6.1.3 | No fix listed |
| netbsd | = 6.1.4 | No fix listed |
| netbsd | = 6.1.5 | No fix listed |
References
- Debian Security Tracker CVE-2014-8517 vendor-advisory
- bugs.debian.org issue-tracking
- NetBSD-SA2014-013 patch vendor-advisory
- APPLE-SA-2015-01-27-4 vendor-advisory
- openSUSE-SU-2014:1383 vendor-advisory
- [oss-security] 20141028 ftp(1) can be made execute arbitrary commands by malicious webserver mailing-list
- [oss-security] 20141028 Re: ftp(1) can be made execute arbitrary commands by malicious webserver mailing-list
- 62028 third-party-advisory
- 62260 third-party-advisory
- support.apple.com
- GLSA-201611-05 vendor-advisory
- 43112 exploit