PT-2014-4296 · Erlang+1 · Erlang/Otp+1

Published 2014-12-08 · Updated 2018-03-16 · CVE-2014-1693

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Erlang/OTP version R15B03

Description The issue allows context-dependent attackers to inject arbitrary FTP commands via CRLF sequences in various commands, including user, account, cd, ls, nlist, rename, delete, mkdir, rmdir, recv, recv bin, recv chunk start, send, send bin, send chunk start, append chunk start, append, and append bin.

Recommendations For Erlang/OTP version R15B03, consider disabling the FTP module until a patch is available to prevent exploitation. Restrict access to the vulnerable commands to minimize the risk of arbitrary FTP command injection. Avoid using the affected commands in the FTP module until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2014-1693

MGASA-2014-0553

USN-3571-1

Affected Products

Erlang/Otp

Ubuntu

References · 32

• 🔥 http://seclists.org/oss-sec/2014/q1/163 · Exploit
• https://cve.org/CVERecord?id=CVE-2014-1693 · Security Note
• https://ubuntu.com/security/CVE-2014-1693 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2014-1693 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3571-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-06977 · Security Note
• https://ubuntu.com/security/CVE-2015-2774 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000385 · Security Note
• https://osv.dev/vulnerability/MGASA-2014-0553 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10253 · Security Note
• https://lists.fedoraproject.org/pipermail/package-announce/2014-December/146184.html · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2015:174 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-1693 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2014-December/145017.html · Vendor Advisory
• https://advisories.mageia.org/MGASA-2014-0553.html · Security Note