CVE-2007-2318

Multiple format string vulnerabilities in FileZilla before 2.2.32 allow remote attackers to execute arbitrary code via format string specifiers in (1) FTP server responses or (2) data sent by an FTP server. NOTE: some of these details are obtained from third party information.

CVSS v2.0 9.3 HIGH

9.3^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:M/Au:N/C:C/I:C/A:C

Exploitability : 8.6 / Impact : 10.0

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://osvdb.org/34436
http://osvdb.org/34437
http://secunia.com/advisories/24894	Patch Vendor Advisory
http://sourceforge.net/project/shownotes.php?release_id=501534&group_id=21558	Patch
http://www.securityfocus.com/bid/23506	Patch

Configurations

Configuration 1 (hide)

cpe:2.3:a:filezilla:filezilla:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2007-04-26 21:19

Updated : 2008-11-13 06:38

NVD link : CVE-2007-2318

Mitre link : CVE-2007-2318

CVE.ORG link : CVE-2007-2318

JSON object : View

Products Affected

filezilla

filezilla

CWE

NVD-CWE-Other

{"id": "CVE-2007-2318", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 9.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": true, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2007-04-26T21:19:00.000", "references": [{"url": "http://osvdb.org/34436", "source": "cve@mitre.org"}, {"url": "http://osvdb.org/34437", "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/24894", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://sourceforge.net/project/shownotes.php?release_id=501534&group_id=21558", "tags": ["Patch"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/23506", "tags": ["Patch"], "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "Multiple format string vulnerabilities in FileZilla before 2.2.32 allow remote attackers to execute arbitrary code via format string specifiers in (1) FTP server responses or (2) data sent by an FTP server. NOTE: some of these details are obtained from third party information."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades de formato de cadena en FileZilla versiones anteriores a 2.2.32 permiten a atacantes remotos ejecutar c\u00f3digo de su elecci\u00f3n mediante especificadores de formato de cadena en (1) Repuestas de servidor FTP \u00f3 (2) datos enviados por un servidor FTP.\r\nNOTA: algunos de estos detalles se han obtenido de informaci\u00f3n de terceros."}], "lastModified": "2008-11-13T06:38:27.917", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:filezilla:filezilla:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BA3E8431-3DD2-483A-8DB6-2F8F0A123755", "versionEndIncluding": "2.2.31"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}