var-200808-0118
Vulnerability from variot

Unspecified vulnerability in Serv-U File Server 7.0.0.1, and other versions before 7.2.0.1, allows remote authenticated users to cause a denial of service (daemon crash) via an SSH session with SFTP commands for directory creation and logging. RhinoSoft Serv-U is prone to a remote denial-of-service vulnerability when handling certain SFTP commands. Exploiting this issue can cause the server to crash and deny service to legitimate users. Versions prior to Serv-U 7.2.0.1 are vulnerable.

The vulnerability is caused due to an error within the logging functionality when creating directories via SFTP. This can be exploited to crash the service.

Successful exploitation requires a valid account with write permissions.

SOLUTION: Update to version 7.2.0.1.

PROVIDED AND/OR DISCOVERED BY: Reported by the vendor.

ORIGINAL ADVISORY: http://www.serv-u.com/releasenotes/

About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities.

Subscribe: http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/

Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.

Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

Show details on source website

To clipboard 

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-200808-0118",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "serv-u file server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "solarwinds",
        "version": "7.0.0.3"
      },
      {
        "model": "serv-u file server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "solarwinds",
        "version": "7.0.0.4"
      },
      {
        "model": "serv-u file server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "solarwinds",
        "version": "7.1.0.1"
      },
      {
        "model": "serv-u file server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "solarwinds",
        "version": "7.2.0.0"
      },
      {
        "model": "serv-u file server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "solarwinds",
        "version": "7.0.0.1"
      },
      {
        "model": "serv-u file server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "solarwinds",
        "version": "7.1.0.0"
      },
      {
        "model": "serv-u file server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "solarwinds",
        "version": "7.1.0.2"
      },
      {
        "model": "serv-u file server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "solarwinds",
        "version": "7.0.0.2"
      },
      {
        "model": "serv-u ftp server",
        "scope": "lt",
        "trust": 0.8,
        "vendor": "rhino",
        "version": "7.0.0.1 and  7.2.0.1"
      },
      {
        "model": "serv-u",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "serv u",
        "version": "7.2.0.0"
      },
      {
        "model": "serv-u",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "serv u",
        "version": "7.1.0.0"
      },
      {
        "model": "serv-u",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "serv u",
        "version": "7.0.0.2"
      },
      {
        "model": "serv-u",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "serv u",
        "version": "7.0.0.3"
      },
      {
        "model": "serv-u",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "serv u",
        "version": "7.0.0.4"
      },
      {
        "model": "serv-u",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "serv u",
        "version": "7.0.0.1"
      },
      {
        "model": "serv-u",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "serv u",
        "version": "7.1.0.2"
      },
      {
        "model": "serv-u",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "serv u",
        "version": "7.1.0.1"
      },
      {
        "model": "software serv-u",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "rhino",
        "version": "7.2.0.0"
      },
      {
        "model": "software serv-u",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "rhino",
        "version": "7.2.0.1"
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "30739"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2008-006155"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200808-269"
      },
      {
        "db": "NVD",
        "id": "CVE-2008-3731"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "cpe_match": [
              {
                "cpe22Uri": "cpe:/a:serv-u:serv-u",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2008-006155"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "RhinoSoft",
    "sources": [
      {
        "db": "BID",
        "id": "30739"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200808-269"
      }
    ],
    "trust": 0.9
  },
  "cve": "CVE-2008-3731",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "PARTIAL",
            "baseScore": 4.0,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 8.0,
            "id": "CVE-2008-3731",
            "impactScore": 2.9,
            "integrityImpact": "NONE",
            "severity": "MEDIUM",
            "trust": 1.8,
            "vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P",
            "version": "2.0"
          }
        ],
        "cvssV3": [],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2008-3731",
            "trust": 1.0,
            "value": "MEDIUM"
          },
          {
            "author": "NVD",
            "id": "CVE-2008-3731",
            "trust": 0.8,
            "value": "Medium"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-200808-269",
            "trust": 0.6,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2008-006155"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200808-269"
      },
      {
        "db": "NVD",
        "id": "CVE-2008-3731"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Unspecified vulnerability in Serv-U File Server 7.0.0.1, and other versions before 7.2.0.1, allows remote authenticated users to cause a denial of service (daemon crash) via an SSH session with SFTP commands for directory creation and logging. RhinoSoft Serv-U is prone to a remote denial-of-service vulnerability when handling certain SFTP commands. \nExploiting this issue can cause the server to crash and deny service to legitimate users. \nVersions prior to Serv-U 7.2.0.1 are vulnerable. \n\nThe vulnerability is caused due to an error within the logging\nfunctionality when creating directories via SFTP. This can be\nexploited to crash the service. \n\nSuccessful exploitation requires a valid account with write\npermissions. \n\nSOLUTION:\nUpdate to version 7.2.0.1. \n\nPROVIDED AND/OR DISCOVERED BY:\nReported by the vendor. \n\nORIGINAL ADVISORY:\nhttp://www.serv-u.com/releasenotes/\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\neverybody keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2008-3731"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2008-006155"
      },
      {
        "db": "BID",
        "id": "30739"
      },
      {
        "db": "PACKETSTORM",
        "id": "69220"
      }
    ],
    "trust": 1.98
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2008-3731",
        "trust": 2.7
      },
      {
        "db": "BID",
        "id": "30739",
        "trust": 1.9
      },
      {
        "db": "SECUNIA",
        "id": "31461",
        "trust": 1.7
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2008-006155",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200808-269",
        "trust": 0.6
      },
      {
        "db": "PACKETSTORM",
        "id": "69220",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "30739"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2008-006155"
      },
      {
        "db": "PACKETSTORM",
        "id": "69220"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200808-269"
      },
      {
        "db": "NVD",
        "id": "CVE-2008-3731"
      }
    ]
  },
  "id": "VAR-200808-0118",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VARIoT devices database",
        "id": null
      }
    ],
    "trust": 1.0
  },
  "last_update_date": "2024-11-23T23:03:13.008000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "Serv-U FTP Server Release Notes",
        "trust": 0.8,
        "url": "http://www.serv-u.com/releasenotes/"
      },
      {
        "title": "SolarWinds Serv-U File Server Security vulnerabilities",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=125151"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2008-006155"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200808-269"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "NVD-CWE-noinfo",
        "trust": 1.0
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2008-3731"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 2.0,
        "url": "http://www.serv-u.com/releasenotes/"
      },
      {
        "trust": 1.6,
        "url": "http://secunia.com/advisories/31461"
      },
      {
        "trust": 1.6,
        "url": "http://www.securityfocus.com/bid/30739"
      },
      {
        "trust": 1.6,
        "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44537"
      },
      {
        "trust": 0.8,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2008-3731"
      },
      {
        "trust": 0.8,
        "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2008-3731"
      },
      {
        "trust": 0.3,
        "url": "http://www.serv-u.com/"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/product/19573/"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/secunia_security_advisories/"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/hardcore_disassembler_and_reverse_engineer/"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/secunia_security_specialist/"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/advisories/31461/"
      },
      {
        "trust": 0.1,
        "url": "http://corporate.secunia.com/about_secunia/64/"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/about_secunia_advisories/"
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "30739"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2008-006155"
      },
      {
        "db": "PACKETSTORM",
        "id": "69220"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200808-269"
      },
      {
        "db": "NVD",
        "id": "CVE-2008-3731"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "BID",
        "id": "30739"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2008-006155"
      },
      {
        "db": "PACKETSTORM",
        "id": "69220"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200808-269"
      },
      {
        "db": "NVD",
        "id": "CVE-2008-3731"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2008-07-30T00:00:00",
        "db": "BID",
        "id": "30739"
      },
      {
        "date": "2012-12-20T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2008-006155"
      },
      {
        "date": "2008-08-20T05:04:04",
        "db": "PACKETSTORM",
        "id": "69220"
      },
      {
        "date": "2008-08-20T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-200808-269"
      },
      {
        "date": "2008-08-20T16:41:00",
        "db": "NVD",
        "id": "CVE-2008-3731"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2015-05-07T17:24:00",
        "db": "BID",
        "id": "30739"
      },
      {
        "date": "2012-12-20T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2008-006155"
      },
      {
        "date": "2020-07-29T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-200808-269"
      },
      {
        "date": "2024-11-21T00:49:59.230000",
        "db": "NVD",
        "id": "CVE-2008-3731"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-200808-269"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Serv-U File Server Service disruption in  (DoS) Vulnerabilities",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2008-006155"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "other",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-200808-269"
      }
    ],
    "trust": 0.6
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.