CVEvulnerability
CVE-2008-4247
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2008-09-25
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-352
Description
ftpd in OpenBSD 4.3, FreeBSD 7.0, NetBSD 4.0, Solaris, and possibly other operating systems interprets long commands from an FTP client as multiple commands, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and execute arbitrary FTP commands via a long ftp:// URI that leverages an existing session from the FTP client implementation in a web browser.
Affected configurations
• freebsd freebsd 7.0
• netbsd netbsd 4.0
• openbsd openbsd 4.3
Related
Weakness · CWE (1)
- CWE-352 Cross-Site Request Forgery weakness
References
- ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2008-014.txt.asc ftp.netbsd.org
- http://bugs.proftpd.org/show_bug.cgi?id=3115 bugs.proftpd.org
- http://secunia.com/advisories/32068 secunia.com
- http://secunia.com/advisories/32070 secunia.com
- http://secunia.com/advisories/33341 secunia.com
- http://security.FreeBSD.org/advisories/FreeBSD-SA-08:12.ftpd.asc security.FreeBSD.org
- http://securityreason.com/achievement_securityalert/56 securityreason.com
- http://securityreason.com/securityalert/4313 securityreason.com
- http://www.openbsd.org/cgi-bin/cvsweb/src/libexec/ftpd/ftpcmd.y www.openbsd.org
- http://www.openbsd.org/cgi-bin/cvsweb/src/libexec/ftpd/ftpcmd.y.diff?r1=1.51&r2=1.52&f=h Exploit
- http://www.openbsd.org/cgi-bin/cvsweb/src/libexec/ftpd/ftpd.c www.openbsd.org
- http://www.openbsd.org/cgi-bin/cvsweb/src/libexec/ftpd/ftpd.c.diff?r1=1.183&r2=1.184&f=h Exploit
- http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html www.oracle.com
- http://www.securitytracker.com/id?1020946 www.securitytracker.com
- http://www.securitytracker.com/id?1021112 www.securitytracker.com
- ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2008-014.txt.asc ftp.netbsd.org
- http://bugs.proftpd.org/show_bug.cgi?id=3115 bugs.proftpd.org
- http://secunia.com/advisories/32068 secunia.com
- http://secunia.com/advisories/32070 secunia.com
- http://secunia.com/advisories/33341 secunia.com
- http://security.FreeBSD.org/advisories/FreeBSD-SA-08:12.ftpd.asc security.FreeBSD.org
- http://securityreason.com/achievement_securityalert/56 securityreason.com
- http://securityreason.com/securityalert/4313 securityreason.com
- http://www.openbsd.org/cgi-bin/cvsweb/src/libexec/ftpd/ftpcmd.y www.openbsd.org
- http://www.openbsd.org/cgi-bin/cvsweb/src/libexec/ftpd/ftpcmd.y.diff?r1=1.51&r2=1.52&f=h Exploit
- http://www.openbsd.org/cgi-bin/cvsweb/src/libexec/ftpd/ftpd.c www.openbsd.org
- http://www.openbsd.org/cgi-bin/cvsweb/src/libexec/ftpd/ftpd.c.diff?r1=1.183&r2=1.184&f=h Exploit
- http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html www.oracle.com
- http://www.securitytracker.com/id?1020946 www.securitytracker.com
- http://www.securitytracker.com/id?1021112 www.securitytracker.com