CVE-2007-4844 - Vulnerability Details - OpenCVE

X-Diesel Unreal Commander 0.92 build 565 and 573 does not properly react to an FTP server's behavior after sending a "CWD /" command, which allows remote FTP servers to cause a denial of service (infinite loop) by (1) repeatedly sending a 550 error response, or (2) sending a 550 error response and then disconnecting.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact None

Integrity Impact None

Availability Impact Partial

This CVE is not in the KEV list.

The EPSS score is 0.00632.

Key SSVC decision points have not yet been added.

Vendors	Products
X-diesel	Unreal Commander

Configuration 1 [-]

OR	cpe:2.3:a:x-diesel:unreal_commander:0.92_build565:::::::*
	cpe:2.3:a:x-diesel:unreal_commander:0.92_build573:::::::*

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2007-4825	X-Diesel Unreal Commander 0.92 build 565 and 573 does not properly react to an FTP server's behavior after sending a "CWD /" command, which allows remote FTP servers to cause a denial of service (infinite loop) by (1) repeatedly sending a 550 error response, or (2) sending a 550 error response and then disconnecting.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
http://blog.hispasec.com/lab/advisories/adv_UnrealCommander_0_92_build_573_Multiple_FTP_Based_Vulnerabilities.txt
http://osvdb.org/39616
http://securityreason.com/securityalert/3125
http://www.securityfocus.com/archive/1/478728/100/0/threaded
http://www.securityfocus.com/bid/25583
https://exchange.xforce.ibmcloud.com/vulnerabilities/36488

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2007-09-12T20:00:00

Updated: 2024-08-07T15:08:33.851Z

Reserved: 2007-09-12T00:00:00

Link: CVE-2007-4844

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2007-09-12T20:17:00.000

Modified: 2025-04-09T00:30:58.490

Link: CVE-2007-4844

Redhat

No data.

OpenCVE Enrichment

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2007-09-06T00:00:00", "descriptions": [{"lang": "en", "value": "X-Diesel Unreal Commander 0.92 build 565 and 573 does not properly react to an FTP server's behavior after sending a \"CWD /\" command, which allows remote FTP servers to cause a denial of service (infinite loop) by (1) repeatedly sending a 550 error response, or (2) sending a 550 error response and then disconnecting."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-10-15T20:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "unrealcommander-ftp-dos(36488)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/36488"}, {"name": "3125", "tags": ["third-party-advisory", "x_refsource_SREASON"], "url": "http://securityreason.com/securityalert/3125"}, {"name": "20070906 [HISPASEC] 2K7SEPT6 X-Diesel Unreal Commander v0.92 (build 573) multiple FTP-based vulnerabilities", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/478728/100/0/threaded"}, {"name": "39616", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://osvdb.org/39616"}, {"tags": ["x_refsource_MISC"], "url": "http://blog.hispasec.com/lab/advisories/adv_UnrealCommander_0_92_build_573_Multiple_FTP_Based_Vulnerabilities.txt"}, {"name": "25583", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/25583"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2007-4844", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "X-Diesel Unreal Commander 0.92 build 565 and 573 does not properly react to an FTP server's behavior after sending a \"CWD /\" command, which allows remote FTP servers to cause a denial of service (infinite loop) by (1) repeatedly sending a 550 error response, or (2) sending a 550 error response and then disconnecting."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "unrealcommander-ftp-dos(36488)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/36488"}, {"name": "3125", "refsource": "SREASON", "url": "http://securityreason.com/securityalert/3125"}, {"name": "20070906 [HISPASEC] 2K7SEPT6 X-Diesel Unreal Commander v0.92 (build 573) multiple FTP-based vulnerabilities", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/478728/100/0/threaded"}, {"name": "39616", "refsource": "OSVDB", "url": "http://osvdb.org/39616"}, {"name": "http://blog.hispasec.com/lab/advisories/adv_UnrealCommander_0_92_build_573_Multiple_FTP_Based_Vulnerabilities.txt", "refsource": "MISC", "url": "http://blog.hispasec.com/lab/advisories/adv_UnrealCommander_0_92_build_573_Multiple_FTP_Based_Vulnerabilities.txt"}, {"name": "25583", "refsource": "BID", "url": "http://www.securityfocus.com/bid/25583"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T15:08:33.851Z"}, "title": "CVE Program Container", "references": [{"name": "unrealcommander-ftp-dos(36488)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/36488"}, {"name": "3125", "tags": ["third-party-advisory", "x_refsource_SREASON", "x_transferred"], "url": "http://securityreason.com/securityalert/3125"}, {"name": "20070906 [HISPASEC] 2K7SEPT6 X-Diesel Unreal Commander v0.92 (build 573) multiple FTP-based vulnerabilities", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://www.securityfocus.com/archive/1/478728/100/0/threaded"}, {"name": "39616", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://osvdb.org/39616"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://blog.hispasec.com/lab/advisories/adv_UnrealCommander_0_92_build_573_Multiple_FTP_Based_Vulnerabilities.txt"}, {"name": "25583", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/25583"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2007-4844", "datePublished": "2007-09-12T20:00:00", "dateReserved": "2007-09-12T00:00:00", "dateUpdated": "2024-08-07T15:08:33.851Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:x-diesel:unreal_commander:0.92_build565:*:*:*:*:*:*:*", "matchCriteriaId": "5E10A135-3DEA-4C76-8BDA-28252FE266E0", "vulnerable": true}, {"criteria": "cpe:2.3:a:x-diesel:unreal_commander:0.92_build573:*:*:*:*:*:*:*", "matchCriteriaId": "A38B09DC-7E74-49EE-AA19-E9A542932AEF", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "X-Diesel Unreal Commander 0.92 build 565 and 573 does not properly react to an FTP server's behavior after sending a \"CWD /\" command, which allows remote FTP servers to cause a denial of service (infinite loop) by (1) repeatedly sending a 550 error response, or (2) sending a 550 error response and then disconnecting."}, {"lang": "es", "value": "X-Diesel Unreal Commander 0.92 build 565 y 573 no reacciona adecuadamente al comportamiento de un servidor FTP tras enviar un comando \"CWD /\", lo cual permite a servidores FTP remotos provocar una denegaci\u00f3n de servicio (bucle infinito) (1) enviando repetidamente una respuesta de error 550, o (2) enviando una respuesta de error 550 y despu\u00e9s desconectando."}], "id": "CVE-2007-4844", "lastModified": "2025-04-09T00:30:58.490", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}]}, "published": "2007-09-12T20:17:00.000", "references": [{"source": "cve@mitre.org", "url": "http://blog.hispasec.com/lab/advisories/adv_UnrealCommander_0_92_build_573_Multiple_FTP_Based_Vulnerabilities.txt"}, {"source": "cve@mitre.org", "url": "http://osvdb.org/39616"}, {"source": "cve@mitre.org", "url": "http://securityreason.com/securityalert/3125"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/archive/1/478728/100/0/threaded"}, {"source": "cve@mitre.org", "tags": ["Exploit"], "url": "http://www.securityfocus.com/bid/25583"}, {"source": "cve@mitre.org", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/36488"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://blog.hispasec.com/lab/advisories/adv_UnrealCommander_0_92_build_573_Multiple_FTP_Based_Vulnerabilities.txt"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://osvdb.org/39616"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://securityreason.com/securityalert/3125"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/archive/1/478728/100/0/threaded"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit"], "url": "http://www.securityfocus.com/bid/25583"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/36488"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "nvd@nist.gov", "type": "Primary"}]}