PT-2010-1239 · Python · Pyftpdlib

Publicado 2010-10-19 · Atualizado 2022-05-01 · CVE-2007-6741

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions pyftpdlib versions prior to 0.2.0

Description The issue concerns the ftp PORT function in FTPServer.py, which does not properly restrict TCP connections to privileged ports under certain conditions. This could potentially allow remote authenticated users to conduct FTP bounce attacks by crafting specific FTP data. An example of such an attack is against a NAT server.

Recommendations For versions prior to 0.2.0, update to version 0.2.0 or later to resolve the issue.

Correção

Improper Privilege Management

Enumeração de Fraquezas

CWE-264

CWE-269

Identificadores relacionados

CVE-2007-6741

GHSA-8XGX-75QW-6268

PYSEC-2010-25

Produtos afetados

Pyftpdlib

Referências · 11

• https://github.com/giampaolo/pyftpdlib/issues/11 · Nota
• https://github.com/giampaolo/pyftpdlib · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/pyftpdlib/PYSEC-2010-25.yaml · Nota
• http://code.google.com/p/pyftpdlib/issues/detail?id=11 · Nota
• https://github.com/advisories/GHSA-8xgx-75qw-6268 · Nota
• https://osv.dev/vulnerability/GHSA-8xgx-75qw-6268 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2007-6741 · Nota de Segurança
• http://code.google.com/p/pyftpdlib/source/browse/trunk/HISTORY · Nota
• http://code.google.com/p/pyftpdlib/source/diff?spec=svn32&r=32&format=side&path=/trunk/pyftpdlib/FTPServer.py · Nota
• https://osv.dev/vulnerability/PYSEC-2010-25 · Aviso do Fabricante
• http://code.google.com/p/pyftpdlib/source/detail?r=32 · Nota