Published: 17/11/2014 Updated: 06/11/2017

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

VMScore: 760

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

The fetch_url function in usr.bin/ftp/fetch.c in tnftp, as used in NetBSD 5.1 up to and including 5.1.4, 5.2 up to and including 5.2.2, 6.0 up to and including 6.0.6, and 6.1 up to and including 6.1.5 allows remote malicious users to execute arbitrary commands via a | (pipe) character at the end of an HTTP redirect.

Vulnerable Product	Search on Vulmon	Subscribe to Product
apple mac os x 10.10.1
apple mac os x 10.10.0
apple mac os x 10.9.5
apple mac os x 10.8.5
netbsd netbsd 5.1.3
netbsd netbsd 5.1.4
netbsd netbsd 5.2
netbsd netbsd 6.0.4
netbsd netbsd 6.0.5
netbsd netbsd 6.1.5
netbsd netbsd 5.1
netbsd netbsd 6.0
netbsd netbsd 6.0.1
netbsd netbsd 6.1.1
netbsd netbsd 6.1.2
netbsd netbsd 5.2.1
netbsd netbsd 5.2.2
netbsd netbsd 6.0.6
netbsd netbsd 6.1
netbsd netbsd 5.1.1
netbsd netbsd 5.1.2
netbsd netbsd 6.0.2
netbsd netbsd 6.0.3
netbsd netbsd 6.1.3
netbsd netbsd 6.1.4

Debian Bug report logs - #767171 tnftp: CVE-2014-8517: ftp(1) can be made execute arbitrary commands by malicious webserver Package: tnftp; Maintainer for tnftp is Anibal Monsalve Salazar <anibal@debianorg>; Source for tnftp is src:tnftp (PTS, buildd, popcon) Reported by: Moritz Muehlenhoff <jmm@debianorg> Date: Tu ...

## # This module requires Metasploit: metasploitcom/download # Current source: githubcom/rapid7/metasploit-framework ## class MetasploitModule < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpServer include Msf::Auxiliary::Report def initialize(info = {}) super(update_info(info, ...

#!/usr/bin/env python2 # # Exploit Title: [tnftp BSD exploit] # Date: [11/29/2014] # Exploit Author: [dash] # Vendor Homepage: [wwwfreebsdorg] # Version: [FreeBSD 8/9/10] # Tested on: [FreeBSD 93] # CVE : [CVE-2014-8517] # tnftp exploit (CVE-2014-8517)tested against freebsd 93 # wwwfreebsdorg/security/advisories/FreeBSD-SA-14:26ftp ...

my little exploit repo

Exploits CVE-2014-8517 FreeBSD tnftp clientside exploit soffice api remote This bug had been found by sud0woodo, he posted a quite exhaustive blog article about it but seemed not to be allowed or wanting to publish the bug, as there had been ongoing discussions with soffice's vendor In the meantime i took the freedom to have a little fun and building my own exploit, but k

Remote code execution flaws fixed in tnftp and wget

The Register • Darren Pauli • 03 Nov 2014

Linux bods thankful, Apple a stone-cold boilerplate

The maintainer of the tnftp FTP client has patched a remote code execution vulnerability which affected operating systems including NetBSD, FreeBSD and Mac OS X. The flaw (CVE-2014-8517), which did not affect OpenBSD due to modifications, was patched over the weekend. Maintainer Luke Mewburn notified NetBSD (which ships tnftp) of the patch in a mailing list post after warning subscribers about the hole last week. NetBSD security bod Alistair Crook forewarned FreeBSD and Dragonfly, and received a...

CVE-2014-8517

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Exploits

Github Repositories

Recent Articles

References

Vulmon Search

About

Products

Connect