CVE-2008-4247

Published: Sep 25, 2008Modified: Apr 23, 2026

7.5

Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability: 10.0 / Impact: 6.4

Source: NVD

Description

ftpd in OpenBSD 4.3, FreeBSD 7.0, NetBSD 4.0, Solaris, and possibly other operating systems interprets long commands from an FTP client as multiple commands, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and execute arbitrary FTP commands via a long ftp:// URI that leverages an existing session from the FTP client implementation in a web browser.

Affected (3)

Products: Freebsd: Freebsd · Netbsd: Netbsd · Openbsd: Openbsd

1 product

1 product

1 product

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Freebsd Freebsd	Version 7.0
Netbsd Netbsd	Version 4.0
Openbsd Openbsd	Version 4.3

Related CWEs

Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

References (30)

ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2008-014.txt.asc (unsafe URL)

Source: cve@mitre.org

http://bugs.proftpd.org/show_bug.cgi?id=3115

Source: cve@mitre.org

http://secunia.com/advisories/32068

Source: cve@mitre.org

http://secunia.com/advisories/32070

Source: cve@mitre.org

http://secunia.com/advisories/33341

Source: cve@mitre.org

http://security.FreeBSD.org/advisories/FreeBSD-SA-08:12.ftpd.asc

Source: cve@mitre.org

http://securityreason.com/achievement_securityalert/56

Source: cve@mitre.org

http://securityreason.com/securityalert/4313

Source: cve@mitre.org

http://www.openbsd.org/cgi-bin/cvsweb/src/libexec/ftpd/ftpcmd.y

Source: cve@mitre.org

http://www.openbsd.org/cgi-bin/cvsweb/src/libexec/ftpd/ftpcmd.y.diff?r1=1.51&r2=1.52&f=h

Source: cve@mitre.org

Exploit

http://www.openbsd.org/cgi-bin/cvsweb/src/libexec/ftpd/ftpd.c

Source: cve@mitre.org

http://www.openbsd.org/cgi-bin/cvsweb/src/libexec/ftpd/ftpd.c.diff?r1=1.183&r2=1.184&f=h

Source: cve@mitre.org

Exploit

http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html

Source: cve@mitre.org

http://www.securitytracker.com/id?1020946

Source: cve@mitre.org

http://www.securitytracker.com/id?1021112

Source: cve@mitre.org

ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2008-014.txt.asc (unsafe URL)

Source: af854a3a-2127-422b-91ae-364da2661108

http://bugs.proftpd.org/show_bug.cgi?id=3115

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/32068

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/32070

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/33341

Source: af854a3a-2127-422b-91ae-364da2661108

http://security.FreeBSD.org/advisories/FreeBSD-SA-08:12.ftpd.asc

Source: af854a3a-2127-422b-91ae-364da2661108

http://securityreason.com/achievement_securityalert/56

Source: af854a3a-2127-422b-91ae-364da2661108

http://securityreason.com/securityalert/4313

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.openbsd.org/cgi-bin/cvsweb/src/libexec/ftpd/ftpcmd.y

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.openbsd.org/cgi-bin/cvsweb/src/libexec/ftpd/ftpcmd.y.diff?r1=1.51&r2=1.52&f=h

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

http://www.openbsd.org/cgi-bin/cvsweb/src/libexec/ftpd/ftpd.c

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.openbsd.org/cgi-bin/cvsweb/src/libexec/ftpd/ftpd.c.diff?r1=1.183&r2=1.184&f=h

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securitytracker.com/id?1020946

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securitytracker.com/id?1021112

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.