PT-2007-5008 · Netwin · Surgeftp

Published 2007-07-15 · Updated 2017-07-29 · CVE-2007-3769

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions SurgeFTP version 2.3a1

Description A cross-site scripting (XSS) issue exists in the mirrored server management interface, allowing remote FTP servers to inject arbitrary web script or HTML via a malformed response without a status code. This injected content is reflected to the user in the resulting error message. It is possible to leverage this issue for root access through a sequence of steps involving web script that creates a new FTP user account.

Recommendations For SurgeFTP version 2.3a1, consider disabling the mirrored server management interface until a patch is available to prevent exploitation of the XSS vulnerability. Restrict access to the management interface to minimize the risk of arbitrary web script or HTML injection.

Fix

Related Identifiers

CVE-2007-3769

Affected Products

Surgeftp

References · 7

• http://secunia.com/advisories/26061 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-3769 · Security Note
• http://marc.info/?l=full-disclosure&m=118409539009277&w=2 · Patch
• http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20070710/98374694/attachment-0031.txt · Note
• http://vupen.com/english/advisories/2007/2528 · Note
• http://osvdb.org/37911 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35378 · Note