|
CVE Reference: CVE-2007-2348
|
|
NOTE: The text on this page is written by CVE MITRE and reflects neither the opinions of Secunia or the results of our research. All data on this page is written and maintained by CVE MITRE.
|
|
Original Page at CVE MITRE:
CVE-2007-2348
|
|
Description:
mirror --script in lftp before 3.5.9 does not properly quote shell metacharacters, which might allow remote user-assisted attackers to execute shell commands via a malicious script. NOTE: it is not clear whether this issue crosses security boundaries, since the script already supports commands such as "get" which could overwrite executable files.
|
|
CVE Status:
Candidate
|
|
References:
SAID
Secunia Advisory: SA25107
Secunia Advisory: SA25132
CONFIRM
http://lftp.yar.ru/news.html
http://bugs.gentoo.org/show_bug.cgi?id=173524
BID
23736
|
|
|
Return to the previous page.
|
