CVE-2008-4247: CSRF

Published Sep 25, 2008

Updated

ftpd in OpenBSD 4.3, FreeBSD 7.0, NetBSD 4.0, Solaris, and possibly other operating systems interprets long commands from an FTP client as multiple commands, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and execute arbitrary FTP commands via a long ftp:// URI that leverages an existing session from the FTP client implementation in a web browser.

Affected Software

3 affected components

FreeBSD FreeBSD=7.0

NetBSD NetBSD=4.0

OpenBSD OpenBSD=4.3

Event History

Sep 25, 2008

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2008-4247?

CVE-2008-4247 is considered a medium severity vulnerability due to its potential for cross-site request forgery (CSRF) attacks.

How do I fix CVE-2008-4247?

To remediate CVE-2008-4247, users should update to a fixed version of the affected software, such as OpenBSD 4.3 or FreeBSD 7.0 that address this issue.

What systems are affected by CVE-2008-4247?

CVE-2008-4247 affects OpenBSD 4.3, FreeBSD 7.0, NetBSD 4.0, Solaris, and possibly other operating systems using vulnerable FTP daemons.

What type of attack does CVE-2008-4247 allow?

CVE-2008-4247 allows remote attackers to conduct cross-site request forgery (CSRF) attacks by manipulating long FTP commands.

Is CVE-2008-4247 still a concern for modern systems?

While CVE-2008-4247 primarily impacts older versions of FTP servers, any legacy systems still running these configurations may still be vulnerable.