oss-sec mailing list archives
Re: CVE id request: ftpd
From: Robert Buchholz <rbu () gentoo org>
Date: Mon, 29 Sep 2008 15:54:55 +0200
On Monday 29 September 2008, Steffen Joeris wrote:
Hi There seems to be a Cross-site request forgery[0] in ftpd.
There have been two CVEs assigned, one for proftpd and one for netkit-ftpd: CVE-2008-4242 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-4242): ProFTPD 1.3.1 interprets long commands from an FTP client as multiple commands, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and execute arbitrary FTP commands via a long ftp:// URI that leverages an existing session from the FTP client implementation in a web browser. CVE-2008-4247 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-4247): ftpd in OpenBSD 4.3, FreeBSD 7.0, and NetBSD 4.0 interprets long commands from an FTP client as multiple commands, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and execute arbitrary FTP commands via a long ftp:// URI that leverages an existing session from the FTP client implementation in a web browser. Robert
Attachment:
signature.asc
Description: This is a digitally signed message part.
Current thread:
- CVE id request: ftpd Steffen Joeris (Sep 29)
- Re: CVE id request: ftpd Robert Buchholz (Sep 29)
- Re: CVE id request: ftpd Steven M. Christey (Sep 30)
- <Possible follow-ups>
- Re: CVE id request: ftpd Josh Bressers (Sep 30)
- Re: CVE id request: ftpd Steven M. Christey (Sep 30)