CVE-2008-4247 Cross-site request forgery in n/a
Remote attackers can execute arbitrary FTP commands via CSRF by exploiting long command interpretation in FTP servers, requiring user interaction with a malicious URI.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2008-4247?
CVE-2008-4247 is a high-severity vulnerability in Freebsd Freebsd, published on 25 Sep 2008. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
ftpd in OpenBSD 4.3, FreeBSD 7.0, NetBSD 4.0, Solaris, and possibly other operating systems interprets long commands from an FTP client as multiple commands, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and execute arbitrary FTP commands via a long ftp:// URI that leverages an existing session from the FTP client implementation in a web browser.
Weakness: CWE-352
Which versions are affected by CVE-2008-4247?
It affects 3 products.
Products include Freebsd Freebsd, Netbsd Netbsd, Openbsd Openbsd.
How do I fix CVE-2008-4247?
Apply the vendor's patch.
Is CVE-2008-4247 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2008-4247 exists.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in Freebsd Freebsd
Sources
Also known as DEBIAN-CVE-2008-4247, GHSA-px9q-8f7r-rv49.