CVE-2007-6741: pyftpdlib FTP Bounce Attack Vulnerability
Summary
CVE-2007-6741: The ftp_PORT function in FTPServer.py in pyftpdlib before 0.2.0 does not prevent TCP connections to privileged ports if the destination IP address matches the source IP address of the connection from the FTP client, whic... Affects pyftpdlib versions < 0.2.0. Fixed in 0.2.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pyftpdlib is a Python FTP server library that provides a high-level interface for implementing FTP servers. It allows developers to create custom FTP servers with various features and configurations. However, versions prior to 0.2.0 are vulnerable to an FTP bounce attack.
Vulnerability Detail
The vulnerability, identified as CVE-2007-6741, exists in the ftp_PORT function of FTPServer.py in pyftpdlib. It fails to prevent TCP connections to privileged ports if the destination IP address matches the source IP address of the connection from the FTP client. This flaw enables remote authenticated users to conduct FTP bounce attacks by sending crafted FTP data. An attacker could exploit this vulnerability to bypass security measures and potentially access unauthorized resources on the target system.
How To Fix
Minimum fixed version
0.2.0
This is the first release that contains the fix.
pip install --upgrade "pyftpdlib==0.2.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the fixed version of pyftpdlib to mitigate the risk of FTP bounce attacks.
Conclusion
The pyftpdlib FTP Bounce Attack vulnerability (CVE-2007-6741) allows remote authenticated users to conduct FTP bounce attacks. It is crucial to update pyftpdlib to version 0.2.0 or later to mitigate the risk of exploitation. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pyftpdlib →
FAQ
pyftpdlib is a Python FTP server library that allows developers to create custom FTP servers.
An FTP bounce attack is a technique where an attacker uses an FTP server as a proxy to scan other hosts on the network.
An attacker with authenticated access to an FTP server running a vulnerable version of pyftpdlib can leverage this vulnerability to conduct FTP bounce attacks.
Exploiting this vulnerability could allow an attacker to bypass security measures and potentially access unauthorized resources on the target system.
Yes, upgrading pyftpdlib to version 0.2.0 or later will fix this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for pyftpdlib.
