CVE-2007-3768 - Vulnerability Details - OpenCVE

The mirror mechanism in SurgeFTP 2.3a1 allows user-assisted, remote FTP servers to cause a denial of service (restart) via a malformed response to a PASV command.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact Complete

This CVE is not in the KEV list.

The EPSS score is 0.00955.

Key SSVC decision points have not yet been added.

Vendors	Products
Netwin	Surgeftp

Configuration 1 [-]

cpe:2.3:a:netwin:surgeftp:*:*:*:*:*:*:*:*

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2007-3752	The mirror mechanism in SurgeFTP 2.3a1 allows user-assisted, remote FTP servers to cause a denial of service (restart) via a malformed response to a PASV command.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20070710/98374694/attachment-0030.txt
http://marc.info/?l=full-disclosure&m=118409539009277&w=2
http://osvdb.org/37909
http://secunia.com/advisories/26061
http://securityreason.com/securityalert/2883
http://www.vupen.com/english/advisories/2007/2528
https://exchange.xforce.ibmcloud.com/vulnerabilities/35376

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2007-07-15T21:00:00

Updated: 2024-08-07T14:28:52.379Z

Reserved: 2007-07-15T00:00:00

Link: CVE-2007-3768

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2007-07-15T21:30:00.000

Modified: 2025-04-09T00:30:58.490

Link: CVE-2007-3768

Redhat

No data.

OpenCVE Enrichment

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2007-07-10T00:00:00", "descriptions": [{"lang": "en", "value": "The mirror mechanism in SurgeFTP 2.3a1 allows user-assisted, remote FTP servers to cause a denial of service (restart) via a malformed response to a PASV command."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-07-28T12:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "26061", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/26061"}, {"name": "37909", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://osvdb.org/37909"}, {"name": "2883", "tags": ["third-party-advisory", "x_refsource_SREASON"], "url": "http://securityreason.com/securityalert/2883"}, {"name": "ADV-2007-2528", "tags": ["vdb-entry", "x_refsource_VUPEN"], "url": "http://www.vupen.com/english/advisories/2007/2528"}, {"name": "surgeftp-pasv-dos(35376)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/35376"}, {"tags": ["x_refsource_MISC"], "url": "http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20070710/98374694/attachment-0030.txt"}, {"name": "20070710 Portcullis Computer Security Ltd - Advisories", "tags": ["mailing-list", "x_refsource_FULLDISC"], "url": "http://marc.info/?l=full-disclosure&m=118409539009277&w=2"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2007-3768", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The mirror mechanism in SurgeFTP 2.3a1 allows user-assisted, remote FTP servers to cause a denial of service (restart) via a malformed response to a PASV command."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "26061", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/26061"}, {"name": "37909", "refsource": "OSVDB", "url": "http://osvdb.org/37909"}, {"name": "2883", "refsource": "SREASON", "url": "http://securityreason.com/securityalert/2883"}, {"name": "ADV-2007-2528", "refsource": "VUPEN", "url": "http://www.vupen.com/english/advisories/2007/2528"}, {"name": "surgeftp-pasv-dos(35376)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/35376"}, {"name": "http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20070710/98374694/attachment-0030.txt", "refsource": "MISC", "url": "http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20070710/98374694/attachment-0030.txt"}, {"name": "20070710 Portcullis Computer Security Ltd - Advisories", "refsource": "FULLDISC", "url": "http://marc.info/?l=full-disclosure&m=118409539009277&w=2"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T14:28:52.379Z"}, "title": "CVE Program Container", "references": [{"name": "26061", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/26061"}, {"name": "37909", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://osvdb.org/37909"}, {"name": "2883", "tags": ["third-party-advisory", "x_refsource_SREASON", "x_transferred"], "url": "http://securityreason.com/securityalert/2883"}, {"name": "ADV-2007-2528", "tags": ["vdb-entry", "x_refsource_VUPEN", "x_transferred"], "url": "http://www.vupen.com/english/advisories/2007/2528"}, {"name": "surgeftp-pasv-dos(35376)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/35376"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20070710/98374694/attachment-0030.txt"}, {"name": "20070710 Portcullis Computer Security Ltd - Advisories", "tags": ["mailing-list", "x_refsource_FULLDISC", "x_transferred"], "url": "http://marc.info/?l=full-disclosure&m=118409539009277&w=2"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2007-3768", "datePublished": "2007-07-15T21:00:00", "dateReserved": "2007-07-15T00:00:00", "dateUpdated": "2024-08-07T14:28:52.379Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:netwin:surgeftp:*:*:*:*:*:*:*:*", "matchCriteriaId": "4A19D3F7-3770-4A85-BD7A-16BBC05001FE", "versionEndIncluding": "2.3a1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The mirror mechanism in SurgeFTP 2.3a1 allows user-assisted, remote FTP servers to cause a denial of service (restart) via a malformed response to a PASV command."}, {"lang": "es", "value": "El mecanismo de espejo del SurgeFTP 2.3a1 permite a atacantes con la intervenci\u00f3n del usuario, a trav\u00e9s de servidores FTP remotos provocar una denegaci\u00f3n de servicio (reinicio) a trav\u00e9s de una respuesta mal formada en el par\u00e1metro PASV."}], "id": "CVE-2007-3768", "lastModified": "2025-04-09T00:30:58.490", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 8.5, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:C", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 7.8, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}]}, "published": "2007-07-15T21:30:00.000", "references": [{"source": "cve@mitre.org", "url": "http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20070710/98374694/attachment-0030.txt"}, {"source": "cve@mitre.org", "url": "http://marc.info/?l=full-disclosure&m=118409539009277&w=2"}, {"source": "cve@mitre.org", "url": "http://osvdb.org/37909"}, {"source": "cve@mitre.org", "tags": ["Patch", "Vendor Advisory"], "url": "http://secunia.com/advisories/26061"}, {"source": "cve@mitre.org", "url": "http://securityreason.com/securityalert/2883"}, {"source": "cve@mitre.org", "url": "http://www.vupen.com/english/advisories/2007/2528"}, {"source": "cve@mitre.org", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/35376"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20070710/98374694/attachment-0030.txt"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://marc.info/?l=full-disclosure&m=118409539009277&w=2"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://osvdb.org/37909"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "http://secunia.com/advisories/26061"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://securityreason.com/securityalert/2883"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.vupen.com/english/advisories/2007/2528"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/35376"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}