FreeBSD : proftpd -- Long Command Processing Vulnerability (0f51f2c9-8956-11dd-a6fe-0030843d3802)

NASLDB: FreeBSD : proftpd -- Long Command Processing Vulnerability (0f51f2c9-8956-11dd-a6fe-0030843d3802)

General

ID: 34256
Name: FreeBSD : proftpd — Long Command Processing Vulnerability (0f51f2c9-8956-11dd-a6fe-0030843d3802)

Summary: Checks for updated packages in pkg_info output

Credits: Tenable Network Security, Inc.

Classification

Risk: –

CVSS: –
CVSS Base Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS Temporal Vector: –

Port: 0
Family: FreeBSD Local Security Checks
Type: Local

Description

Secunia reports :

The vulnerability is caused due to the application truncating an
overly long FTP command, and improperly interpreting the remainder
string as a new FTP command. This can be exploited to execute
arbitrary FTP commands with the privileges of another user by e.g.
tricking the user into following malicious link.

Exploiting

Exploit Available: –
Exploitability Ease: –

Sources

CVE: CVE-2008-4242
OSVDB: –
Bugtraq: –
scipID: –

Timeline

Vulnerability Disclosure: 2008/09/22
Patch Release: 2008/09/23
Plugin Release: 2008/09/23

Plugin

Version: 1.13
Filename: freebsd_pkg_0f51f2c9895611dda6fe0030843d3802.nasl
Filesize: 4601 bytes
MD5 Hash: 7ed711d725dcd017b19657f89dbac38d

Identification: Host/local_checks_enabled
Require Keys: Host/local_checks_enabled", "Host/FreeBSD/release", "Host/FreeBSD/pkg_info
Dependencies: "ssh_get_info.nasl"