FileZilla Server up to 0.9.50 PORT confused deputy

Summaryinfo

A vulnerability, which was classified as problematic, has been found in FileZilla Server up to 0.9.50. The impacted element is an unknown function of the component PORT Handler. Performing a manipulation results in confused deputy. This vulnerability was named CVE-2015-10003. The attack may be initiated remotely. There is no available exploit. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, was found in FileZilla Server up to 0.9.50 (File Transfer Software). This affects an unknown functionality of the component PORT Handler. The manipulation with an unknown input leads to a confused deputy vulnerability. CWE is classifying the issue as CWE-441. The product receives a request, message, or directive from an upstream component, but the product does not sufficiently preserve the original source of the request before forwarding the request to an external actor that is outside of the product's control sphere. This causes the product to appear to be the source of the request, leading it to act as a proxy or other intermediary between the upstream component and the external actor. This is going to have an impact on confidentiality.

The weakness was presented 07/07/2015 by Amit Klein (Website). It is possible to read the advisory at securitygalore.com. This vulnerability is uniquely identified as CVE-2015-10003. It is possible to initiate the attack remotely. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 0.9.51 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at SecurityFocus (BID 74535†). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• File Transfer Software

Vendor

• FileZilla

Name

• Server

Version

• 0.9.0
• 0.9.1
• 0.9.2
• 0.9.3
• 0.9.4
• 0.9.5
• 0.9.6
• 0.9.7
• 0.9.8
• 0.9.9
• 0.9.10
• 0.9.11
• 0.9.12
• 0.9.13
• 0.9.14
• 0.9.15
• 0.9.16
• 0.9.17
• 0.9.18
• 0.9.19
• 0.9.20
• 0.9.21
• 0.9.22
• 0.9.23
• 0.9.24
• 0.9.25
• 0.9.26
• 0.9.27
• 0.9.28
• 0.9.29
• 0.9.30
• 0.9.31
• 0.9.32
• 0.9.33
• 0.9.34
• 0.9.35
• 0.9.36
• 0.9.37
• 0.9.38
• 0.9.39
• 0.9.40
• 0.9.41
• 0.9.42
• 0.9.43
• 0.9.44
• 0.9.45
• 0.9.46
• 0.9.47
• 0.9.48
• 0.9.49
• 0.9.50

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion