Re: CVE id request: ftpd

[Robert Buchholz <rbu () gentoo org>]

On Monday 29 September 2008, Steffen Joeris wrote:
> Hi
>
> There seems to be a Cross-site request forgery[0] in ftpd.

There have been two CVEs assigned, one for proftpd and one for 
netkit-ftpd:

CVE-2008-4242 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-4242):
  ProFTPD 1.3.1 interprets long commands from an FTP client as multiple
  commands, which allows remote attackers to conduct cross-site request
  forgery (CSRF) attacks and execute arbitrary FTP commands via a long
  ftp:// URI that leverages an existing session from the FTP client
  implementation in a web browser.

CVE-2008-4247 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-4247):
  ftpd in OpenBSD 4.3, FreeBSD 7.0, and NetBSD 4.0 interprets long
  commands from an FTP client as multiple commands, which allows remote
  attackers to conduct cross-site request forgery (CSRF) attacks and
  execute arbitrary FTP commands via a long ftp:// URI that leverages
  an existing session from the FTP client implementation in a web
  browser.


Robert

Attachment: signature.asc
Description: This is a digitally signed message part.