Cross-Site Request Forgery Vulnerability in linux-ftpd and linux-ftpd-ssl Packages
Summary
CVE-2008-4247: ftpd in OpenBSD 4.3, FreeBSD 7.0, NetBSD 4.0, Solaris, and possibly other operating systems interprets long commands from an FTP client as multiple commands, which allows remote attackers to conduct cross-site request fo... Affects linux-ftpd versions < 0.17-29. Fixed in 0.17-29. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The linux-ftpd and linux-ftpd-ssl packages are FTP server implementations used in various Linux distributions, including Debian. These packages facilitate file transfers over the Internet using the File Transfer Protocol (FTP). They are designed to handle multiple client connections and provide secure file transfer capabilities. However, these packages are vulnerable to a cross-site request forgery (CSRF) attack due to improper handling of long commands from FTP clients.
Vulnerability Detail
The vulnerability, identified as CVE-2008-4247, arises from the way the ftpd service interprets long commands sent from an FTP client. When a long ftp:// URI is processed, it can be misinterpreted as multiple commands. This flaw allows remote attackers to exploit existing sessions in web browsers, potentially executing arbitrary FTP commands without the user's consent. The vulnerability affects multiple operating systems, including OpenBSD, FreeBSD, NetBSD, and Solaris, in addition to Debian-based systems.
How To Fix
Minimum fixed version
0.17-29
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linux-ftpdTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit the length of commands sent to the FTP server or disable FTP access from untrusted networks until the packages are updated. Additionally, monitoring and logging FTP commands can help identify any unauthorized attempts to exploit this vulnerability.
Conclusion
The CVE-2008-4247 vulnerability poses a significant risk to users of the linux-ftpd and linux-ftpd-ssl packages, allowing for potential unauthorized command execution. It is crucial for users to update their packages to the latest fixed versions and consider implementing workarounds to protect their systems until updates can be applied.
See every vulnerability recorded for linux-ftpd →
FAQ
CVE-2008-4247 is a vulnerability affecting the linux-ftpd and linux-ftpd-ssl packages that allows remote attackers to execute arbitrary FTP commands through long commands sent from an FTP client.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability can allow attackers to perform unauthorized actions on the FTP server, potentially leading to data breaches or unauthorized file transfers.
Yes, patches are available for the linux-ftpd and linux-ftpd-ssl packages. Users should update to the specified fixed versions to mitigate the risk.
If immediate updates are not possible, consider implementing workarounds such as limiting command lengths and monitoring FTP traffic to mitigate potential exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for linux-ftpd.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
