Test ID:	1.3.6.1.4.1.25623.1.0.901006
Category:	FTP
Title:	tnftpd 'ftp://' CSRF Vulnerability
Summary:	tnftpd server is prone to a cross-site request forgery (CSRF) vulnerability.
Description:	Summary: tnftpd server is prone to a cross-site request forgery (CSRF) vulnerability. Vulnerability Insight: The flaw is due to the application truncating an overly long FTP command and improperly interpreting the remainder string as a new FTP command. This can be exploited via unknown vectors, probably involving a crafted 'ftp://' link to a tnftpd server. Vulnerability Impact: Successful exploitation will let the attacker execute arbitrary code to perform CSRF attacks, Web cache poisoning, and other malicious activities. Affected Software/OS: NetBSD, tnftpd Version prior to 20080929 Solution: Upgrade to tnftpd version 20080929 or later. CVSS Score: 6.8 CVSS Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2008-7016 http://osvdb.org/48637 http://secunia.com/advisories/31958 XForce ISS Database: tnftpd-url-csrf(45534) https://exchange.xforce.ibmcloud.com/vulnerabilities/45534
Copyright	Copyright (C) 2009 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.