PT-2010-1454 · Accellion · Accellion Secure File Transfer Appliance

Publicado 2010-02-19 · Atualizado 2017-08-17 · CVE-2009-4644

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Accellion Secure File Transfer Appliance versions prior to 8 0 105

Description The issue allows remote authenticated administrators to bypass the restricted shell and execute arbitrary commands via shell metacharacters to the ping command. This can be achieved by modifying the cli program.

Recommendations For versions prior to 8 0 105, update to version 8 0 105 or later to resolve the issue. As a temporary workaround, consider restricting access to the ping command and limiting the use of shell metacharacters to minimize the risk of exploitation.

Exploit

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2009-4644

Produtos afetados

Accellion Secure File Transfer Appliance

Referências · 5

• 🔥 http://securityfocus.com/bid/38176 · Exploit
• 🔥 http://portcullis-security.com/338.php · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/56248 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4644 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-4644 · Nota de Segurança