CVE-2008-4247
- State
- Published
- Severity
- Not scored
- Published
- Sep 25, 2008
- Updated
- Aug 7, 2024
- Reserved
- Sep 25, 2008
Description
ftpd in OpenBSD 4.3, FreeBSD 7.0, NetBSD 4.0, Solaris, and possibly other operating systems interprets long commands from an FTP client as multiple commands, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and execute arbitrary FTP commands via a long ftp:// URI that leverages an existing session from the FTP client implementation in a web browser.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- 1021112vdb-entry
- http://www.openbsd.org/cgi-bin/cvsweb/src/libexec/ftpd/ftpcmd.y.diff?r1=1.51&r2=1.52&f=h
- 1020946vdb-entry
- 20080926 multiple vendor ftpd - Cross-site request forgerythird-party-advisory
- 33341third-party-advisory
- http://bugs.proftpd.org/show_bug.cgi?id=3115
- http://www.openbsd.org/cgi-bin/cvsweb/src/libexec/ftpd/ftpcmd.y
- 32068third-party-advisory
- FreeBSD-SA-08:12vendor-advisory
- http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html
- 32070third-party-advisory
- http://www.openbsd.org/cgi-bin/cvsweb/src/libexec/ftpd/ftpd.c.diff?r1=1.183&r2=1.184&f=h
- 4313third-party-advisory
- http://www.openbsd.org/cgi-bin/cvsweb/src/libexec/ftpd/ftpd.c
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.