PT-2007-3681 · Lftp+1 · Lftp+1

Published 2007-04-27 · Updated 2023-02-13 · CVE-2007-2348

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions lftp versions prior to 3.5.9

Description The issue is related to the mirror --script feature in lftp, which does not properly quote shell metacharacters. This might allow remote user-assisted attackers to execute shell commands via a malicious script. It is worth noting that the script already supports commands such as "get" which could potentially overwrite executable files.

Recommendations For versions prior to 3.5.9, update to version 3.5.9 or later to resolve the issue. As a temporary workaround, consider restricting the use of the mirror --script feature until a patch is applied. Avoid using potentially malicious scripts with the mirror --script feature to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2007-2348

RHSA-2009:1278

RHSA-2009_1278

Affected Products

Red Hat

Lftp

References · 16

• https://nvd.nist.gov/vuln/detail/CVE-2007-2348 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2007-2348 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2009-1278.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2007-2348 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2007-2348 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2009:1278 · Note
• https://access.redhat.com/security/cve/CVE-2007-2348 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10806 · Note
• http://lftp.yar.ru/news.html · Note
• http://secunia.com/advisories/25132 · Note
• http://vupen.com/english/advisories/2007/1590 · Note
• http://secunia.com/advisories/25107 · Note
• http://securityfocus.com/bid/23736 · Note
• https://issues.rpath.com/browse/RPL-1229 · Note
• http://bugs.gentoo.org/show_bug.cgi?id=173524 · Note