CVE-2009-4648
Accellion Secure File Transfer Appliance - Multiple Command Restriction / Privilege Escalations
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
3Exploited in Wild
-Decision
Descriptions
Accellion Secure File Transfer Appliance before 8_0_105 does not properly restrict access to sensitive commands and arguments that run with extra sudo privileges, which allows local administrators to gain privileges via (1) arbitrary arguments in the --file_move action in /usr/local/bin/admin.pl, or a hard link attack in (2) chmod or (3) a certain cp command.
Accellion Secure File Transfer Appliance anterior a v8_0_105 no restringe adecuadamente el acceso a los comandos sensibles y argumentos que se ejecuta con privilegios sudo adicionales, lo cual permite a los administradores locales obtener privilegios a través de (1)argumentos a su elección en la acción --file_move en /usr/local/bin/admin.pl, o un ataque de enlace duro en (2) chmod o (3) un cierto comando cp.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2010-02-10 First Exploit
- 2010-02-19 CVE Reserved
- 2010-02-19 CVE Published
- 2023-10-13 EPSS Updated
- 2024-08-07 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-264: Permissions, Privileges, and Access Controls
CAPEC
References (4)
| URL | Tag | Source |
|---|---|---|
| https://exchange.xforce.ibmcloud.com/vulnerabilities/56248 | Vdb Entry |
| URL | Date | SRC |
|---|---|---|
| https://www.exploit-db.com/exploits/33623 | 2010-02-10 | |
| http://www.portcullis-security.com/338.php | 2024-08-07 | |
| http://www.securityfocus.com/bid/38176 | 2024-08-07 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Accellion Search vendor "Accellion" | Secure File Transfer Appliance Search vendor "Accellion" for product "Secure File Transfer Appliance" | 7_0_135 Search vendor "Accellion" for product "Secure File Transfer Appliance" and version "7_0_135" | - |
Affected
| ||||||
| Accellion Search vendor "Accellion" | Secure File Transfer Appliance Search vendor "Accellion" for product "Secure File Transfer Appliance" | 7_0_178 Search vendor "Accellion" for product "Secure File Transfer Appliance" and version "7_0_178" | - |
Affected
| ||||||
| Accellion Search vendor "Accellion" | Secure File Transfer Appliance Search vendor "Accellion" for product "Secure File Transfer Appliance" | 7_0_189 Search vendor "Accellion" for product "Secure File Transfer Appliance" and version "7_0_189" | - |
Affected
| ||||||
| Accellion Search vendor "Accellion" | Secure File Transfer Appliance Search vendor "Accellion" for product "Secure File Transfer Appliance" | 7_0_259 Search vendor "Accellion" for product "Secure File Transfer Appliance" and version "7_0_259" | - |
Affected
| ||||||
| Accellion Search vendor "Accellion" | Secure File Transfer Appliance Search vendor "Accellion" for product "Secure File Transfer Appliance" | 7_0_296 Search vendor "Accellion" for product "Secure File Transfer Appliance" and version "7_0_296" | - |
Affected
| ||||||