PT-2007-6023 · Winscp · Winscp

Published 2007-09-17 · Updated 2018-10-15 · CVE-2007-4909

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: WinSCP versions prior to 4.0.4

Description: The issue arises from an interpretation conflict that allows remote attackers to perform arbitrary file transfers with a remote server. This can be achieved via file-transfer commands in the final portion of a URL, specifically affecting scp, and possibly sftp or ftp URLs. For instance, a URL that specifies login to the remote server with a username of scp can be interpreted differently by a web browser's protocol handler and by WinSCP, leading to potential security risks.

Recommendations: For versions prior to 4.0.4, update to version 4.0.4 or later to resolve the issue. As a temporary workaround, consider restricting the use of file-transfer commands in URLs to minimize the risk of exploitation. Avoid using URLs that specify login to the remote server with a username that could be misinterpreted by WinSCP.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2007-4909

Affected Products

Winscp

References · 10

• 🔥 https://exploit-db.com/exploits/30582 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-4909 · Security Note
• http://securityfocus.com/bid/25655 · Patch
• http://secunia.com/advisories/26820 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/36591 · Note
• http://securityreason.com/securityalert/3141 · Note
• http://winscp.cvs.sourceforge.net/winscp/winscp3/core/SessionData.cpp?r1=1.29&r2=1.30 · Note
• http://securityfocus.com/archive/1/479298/100/0/threaded · Note
• http://securitytracker.com/id?1018697 · Note
• http://winscp.net/eng/docs/history · Note