GitHub Advisoryadvisory · PyPI
GHSA-8xgx-75qw-6268 Improper privilege management in pyftpdlib
MEDIUM
Official page ↗
- Aliases
- CVE-2007-6741
- Ecosystem
- PyPI
- Packages
- pyftpdlib
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
- Weaknesses
- CWE-269
- Reviewed
- 2022-06-08
Affected packages
• PyPI pyftpdlib: < 0.2.0 → fixed in 0.2.0
Description
The ftp_PORT function in FTPServer.py in pyftpdlib before 0.2.0 does not prevent TCP connections to privileged ports if the destination IP address matches the source IP address of the connection from the FTP client, which might allow remote authenticated users to conduct FTP bounce attacks via crafted FTP data, as demonstrated by an FTP bounce attack against a NAT server, a related issue to CVE-1999-0017.
Related
Alias · CVE (1)
- CVE-2007-6741 The ftp_PORT function in FTPServer.py in pyftpdlib before 0.2.0 does not prevent TCP connections to privileged ports if the destination IP… vulnerability
Weakness · CWE (1)
- CWE-269 Improper Privilege Management weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2007-6741 advisory
- https://github.com/giampaolo/pyftpdlib/issues/11 web
- https://github.com/giampaolo/pyftpdlib package
- https://github.com/pypa/advisory-database/tree/main/vulns/pyftpdlib/PYSEC-2010-25.yaml web
- http://code.google.com/p/pyftpdlib/issues/detail?id=11 web
- http://code.google.com/p/pyftpdlib/source/browse/trunk/HISTORY web
- http://code.google.com/p/pyftpdlib/source/detail?r=32 web
- http://code.google.com/p/pyftpdlib/source/diff?spec=svn32&r=32&format=side&path=/trunk/pyftpdlib/FTPServer.py web