var-200910-0169
Vulnerability from variot
Rhino Software Serv-U 7.0.0.1 through 8.2.0.3 allows remote attackers to cause a denial of service (server crash) via unspecified vectors related to the "SITE SET TRANSFERPROGRESS ON" FTP command. Serv-U is prone to a denial-of-service vulnerability.
An unspecified error in the Boost module can be exploited to create new directories in the webroot directory of the web server. ----------------------------------------------------------------------
Do you have VARM strategy implemented?
(Vulnerability Assessment Remediation Management)
If not, then implement it through the most reliable vulnerability intelligence source on the market.
Implement it through Secunia.
For more information visit: http://secunia.com/advisories/business_solutions/
Alternatively request a call from a Secunia representative today to discuss how we can help you with our capabilities contact us at: sales@secunia.com
TITLE: Serv-U "SITE SET TRANSFERPROGRESS ON" Denial of Service
SECUNIA ADVISORY ID: SA36873
VERIFY ADVISORY: http://secunia.com/advisories/36873/
DESCRIPTION: A vulnerability has been reported in Serv-U, which can be exploited by malicious users to cause a DoS (Denial of Service).
Successful exploitation requires valid user credentials and that "SITE SET" commands are enabled.
The vulnerability is reported in Serv-U versions 7.0.0.1 through 8.2.0.3.
SOLUTION: Fixed in version 9.0.0.1.
Disable the "SITE SET" command.
PROVIDED AND/OR DISCOVERED BY: Reported by the vendor.
ORIGINAL ADVISORY: http://www.serv-u.com/releasenotes/
About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Show details on source website
{ "@context": { "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#", "affected_products": { "@id": "https://www.variotdbs.pl/ref/affected_products" }, "configurations": { "@id": "https://www.variotdbs.pl/ref/configurations" }, "credits": { "@id": "https://www.variotdbs.pl/ref/credits" }, "cvss": { "@id": "https://www.variotdbs.pl/ref/cvss/" }, "description": { "@id": "https://www.variotdbs.pl/ref/description/" }, "exploit_availability": { "@id": "https://www.variotdbs.pl/ref/exploit_availability/" }, "external_ids": { "@id": "https://www.variotdbs.pl/ref/external_ids/" }, "iot": { "@id": "https://www.variotdbs.pl/ref/iot/" }, "iot_taxonomy": { "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/" }, "patch": { "@id": "https://www.variotdbs.pl/ref/patch/" }, "problemtype_data": { "@id": "https://www.variotdbs.pl/ref/problemtype_data/" }, "references": { "@id": "https://www.variotdbs.pl/ref/references/" }, "sources": { "@id": "https://www.variotdbs.pl/ref/sources/" }, "sources_release_date": { "@id": "https://www.variotdbs.pl/ref/sources_release_date/" }, "sources_update_date": { "@id": "https://www.variotdbs.pl/ref/sources_update_date/" }, "threat_type": { "@id": "https://www.variotdbs.pl/ref/threat_type/" }, "title": { "@id": "https://www.variotdbs.pl/ref/title/" }, "type": { "@id": "https://www.variotdbs.pl/ref/type/" } }, "@id": "https://www.variotdbs.pl/vuln/VAR-200910-0169", "affected_products": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/affected_products#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "model": "serv-u file server", "scope": "eq", "trust": 1.0, "vendor": "solarwinds", "version": "8.0.0.5" }, { "model": "serv-u file server", "scope": "eq", "trust": 1.0, "vendor": "solarwinds", "version": "8.1.0.1" }, { "model": "serv-u file server", "scope": "eq", "trust": 1.0, "vendor": "solarwinds", "version": "8.0.0.1" }, { "model": "serv-u file server", "scope": "eq", "trust": 1.0, "vendor": "solarwinds", "version": "8.2.0.3" }, { "model": "serv-u file server", "scope": "eq", "trust": 1.0, "vendor": "solarwinds", "version": "7.0.0.3" }, { "model": "serv-u file server", "scope": "eq", "trust": 1.0, "vendor": "solarwinds", "version": "7.0.0.4" }, { "model": "serv-u file server", "scope": "eq", "trust": 1.0, "vendor": "solarwinds", "version": "7.1.0.1" }, { "model": "serv-u file server", "scope": "eq", "trust": 1.0, "vendor": "solarwinds", "version": "7.0.0.1" }, { "model": "serv-u file server", "scope": "eq", "trust": 1.0, "vendor": "solarwinds", "version": "7.0.0.2" }, { "model": "serv-u file server", "scope": "eq", "trust": 1.0, "vendor": "solarwinds", "version": "7.4.0.0" }, { "model": "serv-u file server", "scope": "eq", "trust": 1.0, "vendor": "solarwinds", "version": "8.1.0.3" }, { "model": "serv-u file server", "scope": "eq", "trust": 1.0, "vendor": "solarwinds", "version": "8.0.0.4" }, { "model": "serv-u file server", "scope": "eq", "trust": 1.0, "vendor": "solarwinds", "version": "7.4.0.1" }, { "model": "serv-u file server", "scope": "eq", "trust": 1.0, "vendor": "solarwinds", "version": "7.2.0.1" }, { "model": "serv-u file server", "scope": "eq", "trust": 1.0, "vendor": "solarwinds", "version": "7.3.0.2" }, { "model": "serv-u file server", "scope": "eq", "trust": 1.0, "vendor": "solarwinds", "version": "7.3.0.0" }, { "model": "serv-u file server", "scope": "eq", "trust": 1.0, "vendor": "solarwinds", "version": "8.2.0.1" }, { "model": "serv-u file server", "scope": "eq", "trust": 1.0, "vendor": "solarwinds", "version": "7.2.0.0" }, { "model": "serv-u file server", "scope": "eq", "trust": 1.0, "vendor": "solarwinds", "version": "8.2.0.0" }, { "model": "serv-u file server", "scope": "eq", "trust": 1.0, "vendor": "solarwinds", "version": "8.0.0.2" }, { "model": "serv-u file server", "scope": "eq", "trust": 1.0, "vendor": "solarwinds", "version": "7.1.0.0" }, { "model": "serv-u file server", "scope": "eq", "trust": 1.0, "vendor": "solarwinds", "version": "7.1.0.2" }, { "model": "serv-u file server", "scope": "eq", "trust": 1.0, "vendor": "solarwinds", "version": "8.0.0.7" }, { "model": "serv-u file server", "scope": "eq", "trust": 1.0, "vendor": "solarwinds", "version": "7.3.0.1" }, { "model": "serv-u ftp server", "scope": "eq", "trust": 0.8, "vendor": "rhino", "version": "7.0.0.1 to 8.2.0.3" }, { "model": "serv-u", "scope": "eq", "trust": 0.6, "vendor": "serv u", "version": "8.1.0.3" }, { "model": "serv-u", "scope": "eq", "trust": 0.6, "vendor": "serv u", "version": "8.0.0.2" }, { "model": "serv-u", "scope": "eq", "trust": 0.6, "vendor": "serv u", "version": "8.0.0.7" }, { "model": "serv-u", "scope": "eq", "trust": 0.6, "vendor": "serv u", "version": "8.2.0.1" }, { "model": "serv-u", "scope": "eq", "trust": 0.6, "vendor": "serv u", "version": "8.0.0.5" }, { "model": "serv-u", "scope": "eq", "trust": 0.6, "vendor": "serv u", "version": "8.1.0.1" }, { "model": "serv-u", "scope": "eq", "trust": 0.6, "vendor": "serv u", "version": "8.0.0.4" }, { "model": "serv-u", "scope": "eq", "trust": 0.6, "vendor": "serv u", "version": "8.2.0.3" }, { "model": "serv-u", "scope": "eq", "trust": 0.6, "vendor": "serv u", "version": "8.2.0.0" }, { "model": "serv-u", "scope": "eq", "trust": 0.6, "vendor": "serv u", "version": "8.0.0.1" } ], "sources": [ { "db": "JVNDB", "id": "JVNDB-2009-006418" }, { "db": "CNNVD", "id": "CNNVD-200910-177" }, { "db": "NVD", "id": "CVE-2009-3655" } ] }, "configurations": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/configurations#", "children": { "@container": "@list" }, "cpe_match": { "@container": "@list" }, "data": { "@container": "@list" }, "nodes": { "@container": "@list" } }, "data": [ { "CVE_data_version": "4.0", "nodes": [ { "cpe_match": [ { "cpe22Uri": "cpe:/a:serv-u:serv-u", "vulnerable": true } ], "operator": "OR" } ] } ], "sources": [ { "db": "JVNDB", "id": "JVNDB-2009-006418" } ] }, "credits": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/credits#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "Unknown", "sources": [ { "db": "BID", "id": "79286" } ], "trust": 0.3 }, "cve": "CVE-2009-3655", "cvss": { "@context": { "cvssV2": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2" }, "cvssV3": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/" }, "severity": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/cvss/severity#" }, "@id": "https://www.variotdbs.pl/ref/cvss/severity" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "cvssV2": [ { "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "author": "nvd@nist.gov", "availabilityImpact": "PARTIAL", "baseScore": 5.0, "confidentialityImpact": "NONE", "exploitabilityScore": 10.0, "id": "CVE-2009-3655", "impactScore": 2.9, "integrityImpact": "NONE", "severity": "MEDIUM", "trust": 1.8, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0" } ], "cvssV3": [], "severity": [ { "author": "nvd@nist.gov", "id": "CVE-2009-3655", "trust": 1.0, "value": "MEDIUM" }, { "author": "NVD", "id": "CVE-2009-3655", "trust": 0.8, "value": "Medium" }, { "author": "CNNVD", "id": "CNNVD-200910-177", "trust": 0.6, "value": "MEDIUM" } ] } ], "sources": [ { "db": "JVNDB", "id": "JVNDB-2009-006418" }, { "db": "CNNVD", "id": "CNNVD-200910-177" }, { "db": "NVD", "id": "CVE-2009-3655" } ] }, "description": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/description#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "Rhino Software Serv-U 7.0.0.1 through 8.2.0.3 allows remote attackers to cause a denial of service (server crash) via unspecified vectors related to the \"SITE SET TRANSFERPROGRESS ON\" FTP command. Serv-U is prone to a denial-of-service vulnerability. \n\nAn unspecified error in the Boost module can be exploited to create\nnew directories in the webroot directory of the web server. ----------------------------------------------------------------------\n\nDo you have VARM strategy implemented?\n\n(Vulnerability Assessment Remediation Management) \n\nIf not, then implement it through the most reliable vulnerability\nintelligence source on the market. \n\nImplement it through Secunia. \n\nFor more information visit:\nhttp://secunia.com/advisories/business_solutions/\n\nAlternatively request a call from a Secunia representative today to\ndiscuss how we can help you with our capabilities contact us at:\nsales@secunia.com\n\n----------------------------------------------------------------------\n\nTITLE:\nServ-U \"SITE SET TRANSFERPROGRESS ON\" Denial of Service\n\nSECUNIA ADVISORY ID:\nSA36873\n\nVERIFY ADVISORY:\nhttp://secunia.com/advisories/36873/\n\nDESCRIPTION:\nA vulnerability has been reported in Serv-U, which can be exploited\nby malicious users to cause a DoS (Denial of Service). \n\nSuccessful exploitation requires valid user credentials and that\n\"SITE SET\" commands are enabled. \n\nThe vulnerability is reported in Serv-U versions 7.0.0.1 through\n8.2.0.3. \n\nSOLUTION:\nFixed in version 9.0.0.1. \n\nDisable the \"SITE SET\" command. \n\nPROVIDED AND/OR DISCOVERED BY:\nReported by the vendor. \n\nORIGINAL ADVISORY:\nhttp://www.serv-u.com/releasenotes/\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\neverybody keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/advisories/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/advisories/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n", "sources": [ { "db": "NVD", "id": "CVE-2009-3655" }, { "db": "JVNDB", "id": "JVNDB-2009-006418" }, { "db": "BID", "id": "79286" }, { "db": "PACKETSTORM", "id": "81751" }, { "db": "PACKETSTORM", "id": "81782" } ], "trust": 2.07 }, "external_ids": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/external_ids#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "db": "NVD", "id": "CVE-2009-3655", "trust": 2.7 }, { "db": "SECUNIA", "id": "36873", "trust": 1.7 }, { "db": "JVNDB", "id": "JVNDB-2009-006418", "trust": 0.8 }, { "db": "SECUNIA", "id": "36925", "trust": 0.7 }, { "db": "OSVDB", "id": "58424", "trust": 0.6 }, { "db": "XF", "id": "53553", "trust": 0.6 }, { "db": "BID", "id": "36561", "trust": 0.6 }, { "db": "CNNVD", "id": "CNNVD-200910-177", "trust": 0.6 }, { "db": "BID", "id": "79286", "trust": 0.3 }, { "db": "PACKETSTORM", "id": "81751", "trust": 0.1 }, { "db": "PACKETSTORM", "id": "81782", "trust": 0.1 } ], "sources": [ { "db": "BID", "id": "79286" }, { "db": "JVNDB", "id": "JVNDB-2009-006418" }, { "db": "PACKETSTORM", "id": "81751" }, { "db": "PACKETSTORM", "id": "81782" }, { "db": "CNNVD", "id": "CNNVD-200910-177" }, { "db": "NVD", "id": "CVE-2009-3655" } ] }, "id": "VAR-200910-0169", "iot": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/iot#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": true, "sources": [ { "db": "VARIoT devices database", "id": null } ], "trust": 1.0 }, "last_update_date": "2024-11-23T21:47:43.685000Z", "patch": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/patch#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "title": "Serv-U FTP Server Release Notes", "trust": 0.8, "url": "http://www.serv-u.com/releasenotes/" }, { "title": "SolarWinds Serv-U File Server Security vulnerabilities", "trust": 0.6, "url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=125149" } ], "sources": [ { "db": "JVNDB", "id": "JVNDB-2009-006418" }, { "db": "CNNVD", "id": "CNNVD-200910-177" } ] }, "problemtype_data": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "problemtype": "NVD-CWE-noinfo", "trust": 1.0 } ], "sources": [ { "db": "NVD", "id": "CVE-2009-3655" } ] }, "references": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/references#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "trust": 2.0, "url": "http://www.serv-u.com/releasenotes/" }, { "trust": 1.6, "url": "https://oval.cisecurity.org/repository/search/definition/oval%3aorg.mitre.oval%3adef%3a5798" }, { "trust": 1.6, "url": "http://secunia.com/advisories/36873" }, { "trust": 0.8, "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2009-3655" }, { "trust": 0.8, "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2009-3655" }, { "trust": 0.7, "url": "http://drupal.org/node/592490" }, { "trust": 0.7, "url": "http://drupal.org/node/592470" }, { "trust": 0.6, "url": "http://xforce.iss.net/xforce/xfdb/53553" }, { "trust": 0.6, "url": "http://www.securityfocus.com/bid/36561" }, { "trust": 0.6, "url": "http://secunia.com/advisories/36925" }, { "trust": 0.6, "url": "http://osvdb.org/58424" }, { "trust": 0.2, "url": "http://secunia.com/advisories/secunia_security_advisories/" }, { "trust": 0.2, "url": "http://secunia.com/advisories/business_solutions/" }, { "trust": 0.2, "url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org" }, { "trust": 0.2, "url": "http://secunia.com/advisories/about_secunia_advisories/" }, { "trust": 0.1, "url": "http://secunia.com/advisories/36925/" }, { "trust": 0.1, "url": "http://secunia.com/advisories/36873/" } ], "sources": [ { "db": "BID", "id": "79286" }, { "db": "JVNDB", "id": "JVNDB-2009-006418" }, { "db": "PACKETSTORM", "id": "81751" }, { "db": "PACKETSTORM", "id": "81782" }, { "db": "CNNVD", "id": "CNNVD-200910-177" }, { "db": "NVD", "id": "CVE-2009-3655" } ] }, "sources": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", "data": { "@container": "@list" } }, "data": [ { "db": "BID", "id": "79286" }, { "db": "JVNDB", "id": "JVNDB-2009-006418" }, { "db": "PACKETSTORM", "id": "81751" }, { "db": "PACKETSTORM", "id": "81782" }, { "db": "CNNVD", "id": "CNNVD-200910-177" }, { "db": "NVD", "id": "CVE-2009-3655" } ] }, "sources_release_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2009-10-09T00:00:00", "db": "BID", "id": "79286" }, { "date": "2012-12-20T00:00:00", "db": "JVNDB", "id": "JVNDB-2009-006418" }, { "date": "2009-10-01T13:53:27", "db": "PACKETSTORM", "id": "81751" }, { "date": "2009-10-02T13:30:07", "db": "PACKETSTORM", "id": "81782" }, { "date": "2009-10-09T00:00:00", "db": "CNNVD", "id": "CNNVD-200910-177" }, { "date": "2009-10-09T14:30:00.593000", "db": "NVD", "id": "CVE-2009-3655" } ] }, "sources_update_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2009-10-09T00:00:00", "db": "BID", "id": "79286" }, { "date": "2012-12-20T00:00:00", "db": "JVNDB", "id": "JVNDB-2009-006418" }, { "date": "2020-07-29T00:00:00", "db": "CNNVD", "id": "CNNVD-200910-177" }, { "date": "2024-11-21T01:07:54.417000", "db": "NVD", "id": "CVE-2009-3655" } ] }, "threat_type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/threat_type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "remote", "sources": [ { "db": "CNNVD", "id": "CNNVD-200910-177" } ], "trust": 0.6 }, "title": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/title#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "Rhino Software Serv-U Service disruption in (DoS) Vulnerabilities", "sources": [ { "db": "JVNDB", "id": "JVNDB-2009-006418" } ], "trust": 0.8 }, "type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "other", "sources": [ { "db": "CNNVD", "id": "CNNVD-200910-177" } ], "trust": 0.6 } }
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.