CVE-2008-7264: pyftpdlib Denial of Service Vulnerability
Summary
CVE-2008-7264: The ftp_QUIT function in ftpserver.py in pyftpdlib before 0.5.0 allows remote authenticated users to cause a denial of service (file descriptor exhaustion and daemon outage) by sending a QUIT command during a disallowed... Affects pyftpdlib versions < 0.5.0. Fixed in 0.5.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
pyftpdlib is a Python FTP server library that provides a high-level interface for implementing FTP servers. It allows developers to create custom FTP servers with ease. The library is widely used in various Python applications that require FTP server functionality. However, versions prior to 0.5.0 are vulnerable to a denial of service (DoS) attack.
Vulnerability Detail
The vulnerability, identified as CVE-2008-7264, exists in the ftp_QUIT function of pyftpdlib's ftpserver.py module. It allows remote authenticated users to cause a DoS attack by sending a QUIT command during a disallowed data-transfer attempt. This attack leads to file descriptor exhaustion and can result in the outage of the FTP server daemon. The vulnerability can be exploited by authenticated users, potentially disrupting the availability of the FTP server and causing inconvenience to legitimate users.
How To Fix
Minimum fixed version
0.5.0
This is the first release that contains the fix.
pip install --upgrade "pyftpdlib==0.5.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to pyftpdlib version 0.5.0 or later.
Conclusion
The pyftpdlib library prior to version 0.5.0 is vulnerable to a denial of service attack. It is recommended to upgrade to the latest version of pyftpdlib to fix this vulnerability and ensure the security and stability of FTP servers. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pyftpdlib →
FAQ
The vulnerability allows authenticated remote users to cause a denial of service attack, leading to file descriptor exhaustion and the outage of the FTP server daemon.
Users of pyftpdlib versions prior to 0.5.0 are affected by this vulnerability.
You can check the version of pyftpdlib in your application by running 'pip show pyftpdlib' in your terminal or by inspecting your application's dependency configuration.
There are no known public exploits for this vulnerability at the time of this report. However, it is crucial to apply the recommended fix to mitigate the risk.
You can find more information about this vulnerability in the official pyftpdlib advisory database: https://github.com/pypa/advisory-database/blob/main/vulns/pyftpdlib/PYSEC-2010-6.yaml
Related vulnerabilities
Recent vulnerabilities recorded for pyftpdlib.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
