PT-2014-4296 · Erlang+1 · Erlang/Otp+1

Publicado 2014-12-08 · Atualizado 2018-03-16 · CVE-2014-1693

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Erlang/OTP version R15B03

Description The issue allows context-dependent attackers to inject arbitrary FTP commands via CRLF sequences in various commands, including user, account, cd, ls, nlist, rename, delete, mkdir, rmdir, recv, recv bin, recv chunk start, send, send bin, send chunk start, append chunk start, append, and append bin.

Recommendations For Erlang/OTP version R15B03, consider disabling the FTP module until a patch is available to prevent exploitation. Restrict access to the vulnerable commands to minimize the risk of arbitrary FTP command injection. Avoid using the affected commands in the FTP module until the issue is resolved.

Exploit

Correção

Identificadores relacionados

CVE-2014-1693

MGASA-2014-0553

USN-3571-1

Produtos afetados

Erlang/Otp

Ubuntu

Referências · 32

• 🔥 http://seclists.org/oss-sec/2014/q1/163 · Exploit
• https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/ssl/bleichenbacher_oracle.py · Nota
• https://cve.org/CVERecord?id=CVE-2014-1693 · Nota de Segurança
• https://ubuntu.com/security/CVE-2014-1693 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2014-1693 · Aviso do Fabricante
• https://ubuntu.com/security/notices/USN-3571-1 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2024-06977 · Nota de Segurança
• https://ubuntu.com/security/CVE-2015-2774 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2014/01/29 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000385 · Nota de Segurança
• https://osv.dev/vulnerability/MGASA-2014-0553 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10253 · Nota de Segurança
• https://lists.fedoraproject.org/pipermail/package-announce/2014-December/146184.html · Aviso do Fabricante
• http://mandriva.com/security/advisories?name=MDVSA-2015:174 · Aviso do Fabricante
• http://erlang.org/pipermail/erlang-bugs/2014-January/003998.html · Nota