CVE-2008-4247

ftpd in OpenBSD 4.3, FreeBSD 7.0, NetBSD 4.0, Solaris, and possibly other operating systems interprets long commands from an FTP client as multiple commands, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and execute arbitrary FTP commands via a long ftp:// URI that leverages an existing session from the FTP client implementation in a web browser.

Link	Resource
http://www.openbsd.org/cgi-bin/cvsweb/src/libexec/ftpd/ftpcmd.y
http://www.openbsd.org/cgi-bin/cvsweb/src/libexec/ftpd/ftpd.c
http://www.openbsd.org/cgi-bin/cvsweb/src/libexec/ftpd/ftpd.c.diff?r1=1.183&r2=1.184&f=h	Exploit
http://bugs.proftpd.org/show_bug.cgi?id=3115
http://www.openbsd.org/cgi-bin/cvsweb/src/libexec/ftpd/ftpcmd.y.diff?r1=1.51&r2=1.52&f=h	Exploit
http://www.securitytracker.com/id?1020946
http://secunia.com/advisories/32070
http://secunia.com/advisories/32068
http://securityreason.com/achievement_securityalert/56
ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2008-014.txt.asc
http://www.securitytracker.com/id?1021112
http://security.FreeBSD.org/advisories/FreeBSD-SA-08:12.ftpd.asc
http://secunia.com/advisories/33341
http://securityreason.com/securityalert/4313
http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html

Configuration 1

cpe:2.3:o:netbsd:netbsd:4.0:*:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:7.0:*:*:*:*:*:*:* cpe:2.3:o:openbsd:openbsd:4.3:*:*:*:*:*:*:*

---

Published : 2008-09-25 07:25

Updated : 2012-10-23 02:53

---

NVD link : CVE-2008-4247

Mitre link : CVE-2008-4247

No products.

CWE-352