PT-2007-7139 · Netkit · Netkit-Ftp

Published 2007-12-06 · Updated 2009-09-15 · CVE-2007-6263

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions netkit-ftpd version 0.17

Description The issue is related to the dataconn function in ftpd.c, which calls fclose on an uninitialized file stream when certain modifications to support SSL are introduced. This allows remote attackers to cause a denial of service, potentially crashing the daemon, and may have other unspecified impacts via certain FTP over SSL protocol behaviors, such as breaking a passive FTP DATA connection and triggering an error in the server's SSL accept function.

Recommendations For netkit-ftpd version 0.17, consider disabling the SSL support temporarily as a workaround to minimize the risk of exploitation until a patch is available.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2007-6263

Affected Products

Netkit-Ftp

References · 10

• 🔥 http://bugs.gentoo.org/show_bug.cgi?id=199206 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-6263 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2007-6263 · Vendor Advisory
• http://gentoo.org/security/en/glsa/glsa-200801-17.xml · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2007-6263 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2007-6263 · Vendor Advisory
• http://securityfocus.com/bid/26763 · Note
• http://secunia.com/advisories/28697 · Note
• http://osvdb.org/41191 · Note
• http://marc.info/?l=full-disclosure&m=119704348003382&w=2 · Note