PT-2010-1239 · Python · Pyftpdlib

Published 2010-10-19 · Updated 2022-05-01 · CVE-2007-6741

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions pyftpdlib versions prior to 0.2.0

Description The issue concerns the ftp PORT function in FTPServer.py, which does not properly restrict TCP connections to privileged ports under certain conditions. This could potentially allow remote authenticated users to conduct FTP bounce attacks by crafting specific FTP data. An example of such an attack is against a NAT server.

Recommendations For versions prior to 0.2.0, update to version 0.2.0 or later to resolve the issue.

Fix

Improper Privilege Management

Weakness Enumeration

CWE-264

CWE-269

Related Identifiers

CVE-2007-6741

GHSA-8XGX-75QW-6268

PYSEC-2010-25

Affected Products

Pyftpdlib

References · 11

• https://osv.dev/vulnerability/GHSA-8xgx-75qw-6268 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-6741 · Security Note
• https://osv.dev/vulnerability/PYSEC-2010-25 · Vendor Advisory
• https://github.com/giampaolo/pyftpdlib/issues/11 · Note
• https://github.com/giampaolo/pyftpdlib · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/pyftpdlib/PYSEC-2010-25.yaml · Note
• http://code.google.com/p/pyftpdlib/issues/detail?id=11 · Note
• https://github.com/advisories/GHSA-8xgx-75qw-6268 · Note
• http://code.google.com/p/pyftpdlib/source/browse/trunk/HISTORY · Note
• http://code.google.com/p/pyftpdlib/source/diff?spec=svn32&r=32&format=side&path=/trunk/pyftpdlib/FTPServer.py · Note
• http://code.google.com/p/pyftpdlib/source/detail?r=32 · Note