Denial of Service Vulnerability in python-pyftpdlib: CVE-2010-3494
Summary
DEBIAN-CVE-2010-3494: Race condition in the FTPHandler class in ftpserver.py in pyftpdlib before 0.5.2 allows remote attackers to cause a denial of service (daemon outage) by establishing and then immediately closing a TCP connection, leading... Affects python-pyftpdlib versions < 0.5.2-1. Fixed in 0.5.2-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
python-pyftpdlib is a Python library that implements a fully functional FTP server. It is designed to be easy to use and extend, making it a popular choice for developers needing FTP functionality in their applications. However, prior to version 0.5.2, it was susceptible to a race condition vulnerability that could lead to service disruptions.
Vulnerability Detail
The vulnerability, identified as CVE-2010-3494, arises from a race condition in the FTPHandler class within ftpserver.py. This flaw allows remote attackers to cause a denial of service by quickly establishing and then closing a TCP connection. This can lead to the accept function receiving an unexpected value of None for the address or encountering errors such as ECONNABORTED, EAGAIN, or EWOULDBLOCK. The implications of this vulnerability can result in the FTP server becoming unresponsive, affecting availability for legitimate users.
How To Fix
Minimum fixed version
0.5.2-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-pyftpdlibTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement connection limits or monitor and restrict the rate of incoming connections to mitigate the impact of the vulnerability until the package can be updated.
Conclusion
In summary, CVE-2010-3494 is a denial of service vulnerability in the python-pyftpdlib package that can be exploited by remote attackers. It is crucial to update to the patched version to ensure the security and availability of your FTP server. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for python-pyftpdlib →
FAQ
CVE-2010-3494 is a vulnerability in the python-pyftpdlib package that allows remote attackers to cause a denial of service by exploiting a race condition in the FTPHandler class.
You can use Vulert, which monitors open-source vulnerabilities in your software. By simply using a manifest file like package-lock.json, you can check for vulnerabilities without needing to access the code.
The main consequence is a denial of service, where the FTP server may become unresponsive, preventing legitimate users from accessing it.
Yes, the vulnerability is fixed in version 0.5.2-1 of python-pyftpdlib. Updating to this version or later will resolve the issue.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for python-pyftpdlib.
