• 공개일 : 2008-09-26
• 변경일 : 2010-07-22

• 위험도: 7.5
• 액세스 벡터 : NETWORK
• 액세스 복잡성 : 낮음
• 인증 : 없음
• 기밀성 영향 : 부분
• 무결성 영향 : 부분
• 가용성 영향 : 부분
• 출처 : http://nvd.nist.gov
• 공개일 : 2008-09-27

ftpd in OpenBSD 4.3, FreeBSD 7.0, NetBSD 4.0, Solaris, and possibly other operating systems interprets long commands from an FTP client as multiple commands, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and execute arbitrary FTP commands via a long ftp:// URI that leverages an existing session from the FTP client implementation in a web browser.

• SECTRACK, 1021112
• SECTRACK, 1020946
• CONFIRM, http://www.oracle.com/technology/deploy/security/critical-patch-updat..
• CONFIRM, http://www.openbsd.org/cgi-bin/cvsweb/src/libexec/ftpd/ftpd.c.diff?r1..
• CONFIRM, http://www.openbsd.org/cgi-bin/cvsweb/src/libexec/ftpd/ftpd.c
• CONFIRM, http://www.openbsd.org/cgi-bin/cvsweb/src/libexec/ftpd/ftpcmd.y.diff?..
• CONFIRM, http://www.openbsd.org/cgi-bin/cvsweb/src/libexec/ftpd/ftpcmd.y
• SREASON, 4313
• SREASONRES, 20080926 multiple vendor ftpd - Cross-site request forgery
• FREEBSD, FreeBSD-SA-08:12
• SECUNIA, 33341
• SECUNIA, 32070
• SECUNIA, 32068
• MISC, http://bugs.proftpd.org/show_bug.cgi?id=3115
• NETBSD, NetBSD-SA2008-014

• netbsd netbsd 4.0
• openbsd openbsd 4.3
• freebsd freebsd 7.0