CVE-2008-4247

Description

ftpd in OpenBSD 4.3, FreeBSD 7.0, NetBSD 4.0, Solaris, and possibly other operating systems interprets long commands from an FTP client as multiple commands, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and execute arbitrary FTP commands via a long ftp:// URI that leverages an existing session from the FTP client implementation in a web browser.

References

http://www.securitytracker.com/id?1021112

http://www.securitytracker.com/id?1020946

http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html

http://www.openbsd.org/cgi-bin/cvsweb/src/libexec/ftpd/ftpd.c

http://www.openbsd.org/cgi-bin/cvsweb/src/libexec/ftpd/ftpcmd.y

http://securityreason.com/securityalert/4313

http://securityreason.com/achievement_securityalert/56

http://security.FreeBSD.org/advisories/FreeBSD-SA-08:12.ftpd.asc

http://secunia.com/advisories/33341

http://secunia.com/advisories/32070

http://secunia.com/advisories/32068

http://bugs.proftpd.org/show_bug.cgi?id=3115

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3