PT-2007-5981 · Diesel · X-Diesel Unreal Commander

Published 2007-09-12 · Updated 2018-10-15 · CVE-2007-4844

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions: X-Diesel Unreal Commander version 0.92 build 565 X-Diesel Unreal Commander version 0.92 build 573

Description: The issue arises when the software does not properly handle an FTP server's behavior after sending a "CWD /" command. This can lead to a denial of service in the form of an infinite loop. The denial of service can occur in two ways: (1) the FTP server repeatedly sends a 550 error response, or (2) the FTP server sends a 550 error response and then disconnects.

Recommendations: For X-Diesel Unreal Commander version 0.92 build 565, consider restricting access to FTP servers that may exploit this issue until a patch is available. For X-Diesel Unreal Commander version 0.92 build 573, avoid using the CWD / command in the affected FTP client until the issue is resolved.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2007-4844

Affected Products

X-Diesel Unreal Commander

References · 7

• 🔥 http://securityfocus.com/bid/25583 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-4844 · Security Note
• http://blog.hispasec.com/lab/advisories/adv_UnrealCommander_0_92_build_573_Multiple_FTP_Based_Vulnerabilities.txt · Note
• http://securityreason.com/securityalert/3125 · Note
• http://osvdb.org/39616 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/36488 · Note
• http://securityfocus.com/archive/1/478728/100/0/threaded · Note