PT-2007-7139 · Netkit · Netkit-Ftp

Publicado 2007-12-06 · Atualizado 2009-09-15 · CVE-2007-6263

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions netkit-ftpd version 0.17

Description The issue is related to the dataconn function in ftpd.c, which calls fclose on an uninitialized file stream when certain modifications to support SSL are introduced. This allows remote attackers to cause a denial of service, potentially crashing the daemon, and may have other unspecified impacts via certain FTP over SSL protocol behaviors, such as breaking a passive FTP DATA connection and triggering an error in the server's SSL accept function.

Recommendations For netkit-ftpd version 0.17, consider disabling the SSL support temporarily as a workaround to minimize the risk of exploitation until a patch is available.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2007-6263

Produtos afetados

Netkit-Ftp

Referências · 10

• 🔥 http://bugs.gentoo.org/show_bug.cgi?id=199206 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-6263 · Nota de Segurança
• https://security-tracker.debian.org/tracker/CVE-2007-6263 · Aviso do Fabricante
• http://gentoo.org/security/en/glsa/glsa-200801-17.xml · Aviso do Fabricante
• http://securityfocus.com/bid/26763 · Nota
• http://secunia.com/advisories/28697 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2007-6263 · Aviso do Fabricante
• http://osvdb.org/41191 · Nota
• https://osv.dev/vulnerability/CVE-2007-6263 · Aviso do Fabricante
• http://marc.info/?l=full-disclosure&m=119704348003382&w=2 · Nota