CVE-2014-1693: CRLF Injection
An FTP command injection flaw was found [1] in Erlang's FTP module. Several functions in the FTP module do not properly sanitize the input before passing it into a control socket. A local attacker can use this flaw to execute arbitrary FTP commands on a system that uses this module.
This issue has been reported upstream [2], but has not yet been fixed.
[1] http://seclists.org/oss-sec/2014/q1/163 [2] http://erlang.org/pipermail/erlang-bugs/2014-January/003998.html
Other sources
Multiple CRLF injection vulnerabilities in the FTP module in Erlang/OTP R15B03 allow context-dependent attackers to inject arbitrary FTP commands via CRLF sequences in the (1) user, (2) account, (3) cd, (4) ls, (5) nlist, (6) rename, (7) delete, (8) mkdir, (9) rmdir, (10) recv, (11) recvbin, (12) recvchunkstart, (13) send, (14) sendbin, (15) sendchunkstart, (16) appendchunkstart, (17) append, or (18) appendbin command.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2014-1693?
CVE-2014-1693 has a medium severity rating due to the potential for local attackers to exploit the FTP command injection flaw.
How do I fix CVE-2014-1693?
To remediate CVE-2014-1693, update the Erlang package to a version that is not vulnerable, such as 1:23.2.6+dfsg-1+deb11u1 or later.
Which versions of Erlang are affected by CVE-2014-1693?
CVE-2014-1693 affects Erlang versions prior to 1:23.2.6+dfsg-1 and 1:25.2.3+dfsg-1.
Can CVE-2014-1693 be exploited remotely?
No, CVE-2014-1693 is a local vulnerability that requires an attacker to have local access to the system.
What impact does CVE-2014-1693 have on systems using the Erlang FTP module?
CVE-2014-1693 allows an attacker to execute arbitrary FTP commands on a system, which can lead to unauthorized access or data manipulation.