CVE-2014-1693

Multiple CRLF injection vulnerabilities in the FTP module in Erlang/OTP R15B03 allow context-dependent attackers to inject arbitrary FTP commands via CRLF sequences in the (1) user, (2) account, (3) cd, (4) ls, (5) nlist, (6) rename, (7) delete, (8) mkdir, (9) rmdir, (10) recv, (11) recv_bin, (12) recv_chunk_start, (13) send, (14) send_bin, (15) send_chunk_start, (16) append_chunk_start, (17) append, or (18) append_bin command.

CVSS v2.0 7.5 HIGH

7.5^/10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://bugzilla.redhat.com/show_bug.cgi?id=1059331
http://seclists.org/oss-sec/2014/q1/163	Exploit
http://lists.fedoraproject.org/pipermail/package-announce/2014-December/145017.html
http://advisories.mageia.org/MGASA-2014-0553.html
http://www.mandriva.com/security/advisories?name=MDVSA-2015:174
https://usn.ubuntu.com/3571-1/

Configurations

Configuration 1 (hide)

cpe:2.3:a:erlang:erlang\/otp:r15b03:*:*:*:*:*:*:*

Information

Published : 2014-12-08 03:59

Updated : 2018-03-15 18:29

NVD link : CVE-2014-1693

Mitre link : CVE-2014-1693

JSON object : View

CWE

NVD-CWE-Other

Products Affected

erlang

erlang\/otp

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1059331", "name": "https://bugzilla.redhat.com/show_bug.cgi?id=1059331", "tags": [], "refsource": "CONFIRM"}, {"url": "http://seclists.org/oss-sec/2014/q1/163", "name": "[oss-security] 20140128 CVE Request: Erlang OTP - ftp module - FTP Command Injection", "tags": ["Exploit"], "refsource": "MLIST"}, {"url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-December/145017.html", "name": "FEDORA-2014-15394", "tags": [], "refsource": "FEDORA"}, {"url": "http://advisories.mageia.org/MGASA-2014-0553.html", "name": "http://advisories.mageia.org/MGASA-2014-0553.html", "tags": [], "refsource": "CONFIRM"}, {"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:174", "name": "MDVSA-2015:174", "tags": [], "refsource": "MANDRIVA"}, {"url": "https://usn.ubuntu.com/3571-1/", "name": "USN-3571-1", "tags": [], "refsource": "UBUNTU"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Multiple CRLF injection vulnerabilities in the FTP module in Erlang/OTP R15B03 allow context-dependent attackers to inject arbitrary FTP commands via CRLF sequences in the (1) user, (2) account, (3) cd, (4) ls, (5) nlist, (6) rename, (7) delete, (8) mkdir, (9) rmdir, (10) recv, (11) recv_bin, (12) recv_chunk_start, (13) send, (14) send_bin, (15) send_chunk_start, (16) append_chunk_start, (17) append, or (18) append_bin command."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2014-1693", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "severity": "HIGH", "impactScore": 6.4, "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2014-12-08T11:59Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:erlang:erlang\\/otp:r15b03:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2018-03-16T01:29Z"}

7.5 /10