PT-2010-1454 · Accellion · Accellion Secure File Transfer Appliance

Published 2010-02-19 · Updated 2017-08-17 · CVE-2009-4644

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Accellion Secure File Transfer Appliance versions prior to 8 0 105

Description The issue allows remote authenticated administrators to bypass the restricted shell and execute arbitrary commands via shell metacharacters to the ping command. This can be achieved by modifying the cli program.

Recommendations For versions prior to 8 0 105, update to version 8 0 105 or later to resolve the issue. As a temporary workaround, consider restricting access to the ping command and limiting the use of shell metacharacters to minimize the risk of exploitation.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2009-4644

Affected Products

Accellion Secure File Transfer Appliance

References · 5

• 🔥 http://securityfocus.com/bid/38176 · Exploit
• 🔥 http://portcullis-security.com/338.php · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-4644 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/56248 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4644 · Note