UnratedFix available
linux-ftpd, linux-ftpd-ssl — security advisory
ftpd in OpenBSD 4.3, FreeBSD 7.0, NetBSD 4.0, Solaris, and possibly other operating systems interprets long commands from an FTP client as multiple commands, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and execute arbitrary FTP commands via a long ftp:// URI that leverages an existing session from the FTP client implementation in a web browser.
- Products
- linux-ftpd, linux-ftpd-ssl
- Affected versions
- 0.17.12+0.3-2, 0.17.18+0.3-3, 0.17.18+0.3-3sarge1, 0.17.18+0.3-4, 0.17.18+0.3-5, 0.17.18+0.3-6, 0.17.18+0.3-6etch1, 0.17.18+0.3-7, 0.17.18+0.3-8, 0.17.18+0.3-9, 0.17.18+0.3-9.1, 0.17.27+0.3-1, 0.17.27+0.3-2
- Fixed versions
- 0.17-29, 0.17.27+0.3-3
- CVEs
- CVE-2008-4247
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 23:03 UTC · Revision 1
Source evidence
ftpd in OpenBSD 4.3, FreeBSD 7.0, NetBSD 4.0, Solaris, and possibly other operating systems interprets long commands from an FTP client as multiple commands, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and execute arbitrary FTP commands via a long ftp:// URI that leverages an existing session from the FTP client implementation in a web browser.
osv:DEBIAN-CVE-2008-4247
linux-ftpd
Fixed versions: 0.17-29
linux-ftpd-ssl
Fixed versions: 0.17.27+0.3-3
linux-ftpd-ssl
Fixed versions: 0.17.27+0.3-3
Complete source record
{
"id": "7b34dc882f15e4754bf9611dae4d0817da0d32c5b2593fb1aa2654cc5da74bab",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2008-4247",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2008-4247",
"summary": "ftpd in OpenBSD 4.3, FreeBSD 7.0, NetBSD 4.0, Solaris, and possibly other operating systems interprets long commands from an FTP client as multiple commands, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and execute arbitrary FTP commands via a long ftp:// URI that leverages an existing session from the FTP client implementation in a web browser.",
"evidence": "osv:DEBIAN-CVE-2008-4247",
"products": [
{
"name": {
"value": "linux-ftpd",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "0.17-29",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "linux-ftpd-ssl",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "0.17.27+0.3-3",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "linux-ftpd-ssl",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "0.17.27+0.3-3",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": [
{
"value": "0.17.12+0.3-2",
"evidence": "/affected/2/versions"
},
{
"value": "0.17.18+0.3-3",
"evidence": "/affected/2/versions"
},
{
"value": "0.17.18+0.3-3sarge1",
"evidence": "/affected/2/versions"
},
{
"value": "0.17.18+0.3-4",
"evidence": "/affected/2/versions"
},
{
"value": "0.17.18+0.3-5",
"evidence": "/affected/2/versions"
},
{
"value": "0.17.18+0.3-6",
"evidence": "/affected/2/versions"
},
{
"value": "0.17.18+0.3-6etch1",
"evidence": "/affected/2/versions"
},
{
"value": "0.17.18+0.3-7",
"evidence": "/affected/2/versions"
},
{
"value": "0.17.18+0.3-8",
"evidence": "/affected/2/versions"
},
{
"value": "0.17.18+0.3-9",
"evidence": "/affected/2/versions"
},
{
"value": "0.17.18+0.3-9.1",
"evidence": "/affected/2/versions"
},
{
"value": "0.17.27+0.3-1",
"evidence": "/affected/2/versions"
},
{
"value": "0.17.27+0.3-2",
"evidence": "/affected/2/versions"
}
]
}
],
"severity": "unknown",
"structured": {
"id": "DEBIAN-CVE-2008-4247",
"aliases": [
"DEBIAN-CVE-2008-4247"
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.17-29"
}
]
}
],
"package": {
"name": "linux-ftpd",
"purl": "pkg:deb/debian/linux-ftpd?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2008-4247.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.17.27+0.3-3"
}
]
}
],
"package": {
"name": "linux-ftpd-ssl",
"purl": "pkg:deb/debian/linux-ftpd-ssl?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2008-4247.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.17.27+0.3-3"
}
]
}
],
"package": {
"name": "linux-ftpd-ssl",
"purl": "pkg:deb/debian/linux-ftpd-ssl?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"versions": [
"0.17.12+0.3-2",
"0.17.18+0.3-3",
"0.17.18+0.3-3sarge1",
"0.17.18+0.3-4",
"0.17.18+0.3-5",
"0.17.18+0.3-6",
"0.17.18+0.3-6etch1",
"0.17.18+0.3-7",
"0.17.18+0.3-8",
"0.17.18+0.3-9",
"0.17.18+0.3-9.1",
"0.17.27+0.3-1",
"0.17.27+0.3-2"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2008-4247.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
],
"modified": "2026-10-23T17:47:33.349740240Z",
"provider": "osv",
"upstream": [
"CVE-2008-4247"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2008-4247"
]
},
"related_cves": [
{
"value": "CVE-2008-4247",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 417598,
"published_at": "2008-09-25T19:25:18.817+00:00"
}