CVE-2007-2348
First published: Fri Apr 27 2007(Updated: )
mirror --script in lftp before 3.5.9 does not properly quote shell metacharacters, which might allow remote user-assisted attackers to execute shell commands via a malicious script. NOTE: it is not clear whether this issue crosses security boundaries, since the script already supports commands such as "get" which could overwrite executable files.
Credit: secalert@redhat.com secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| lftp | <=3.5.8 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://bugs.gentoo.org/show_bug.cgi?id=173524
- http://lftp.yar.ru/news.html
- https://issues.rpath.com/browse/RPL-1229
- http://www.securityfocus.com/bid/23736
- http://secunia.com/advisories/25107
- http://secunia.com/advisories/25132
- http://www.vupen.com/english/advisories/2007/1590
- http://rhn.redhat.com/errata/RHSA-2009-1278.html
- http://secunia.com/advisories/36559
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10806
Frequently Asked Questions
What is the severity of CVE-2007-2348?
CVE-2007-2348 is considered to be a moderate severity vulnerability as it allows remote user-assisted attackers to execute shell commands.
How do I fix CVE-2007-2348?
To fix CVE-2007-2348, update lftp to version 3.5.9 or later.
What systems are affected by CVE-2007-2348?
CVE-2007-2348 affects lftp versions prior to 3.5.9.
What type of attack does CVE-2007-2348 enable?
CVE-2007-2348 enables remote user-assisted code execution through improperly quoted shell metacharacters in scripts.
Is CVE-2007-2348 a critical vulnerability?
CVE-2007-2348 is not classified as critical, but it poses a risk if exploited by an attacker.
- agent/references
- agent/author
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/last-modified-date
- agent/weakness
- agent/first-publish-date
- agent/description
- agent/event
- agent/source
- agent/tags
- collector/nvd-api
- agent/software-canonical-lookup-request
- collector/nvd-historical
- collector/nvd-index
- vendor/alexander v. lukyanov
- canonical/lftp
- version/lftp/3.5.8