CVE-2010-3494: pyftpdlib FTPHandler Class Race Condition Denial of Service
Summary
CVE-2009-5010: Race condition in the FTPHandler class in ftpserver.py in pyftpdlib before 0.5.1 allows remote attackers to cause a denial of service (daemon outage) by establishing and then immediately closing a TCP connection, leading... Affects pyftpdlib versions < 0.5.1. Fixed in 0.5.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pyftpdlib is a Python FTP server library that provides a high-level interface for implementing FTP servers. It allows developers to create custom FTP servers with ease. The FTPHandler class in pyftpdlib is responsible for handling FTP connections and managing server functionality. However, versions prior to 0.5.1 are vulnerable to a race condition that can lead to a denial of service (daemon outage) when a remote attacker establishes and immediately closes a TCP connection. This vulnerability is different from CVE-2010-3494.
Vulnerability Detail
The vulnerability in the FTPHandler class of pyftpdlib arises due to a race condition. When a remote attacker establishes and quickly closes a TCP connection, the accept function in ftpserver.py may return an unexpected value of None. This unexpected return value can cause the FTP server daemon to crash or become unresponsive, resulting in a denial of service. The impact of this vulnerability is a temporary outage of the FTP server, which can disrupt normal operations and affect users' ability to access and transfer files.
How To Fix
Minimum fixed version
0.5.1
This is the first release that contains the fix.
pip install --upgrade "pyftpdlib==0.5.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to pyftpdlib version 0.5.1 or later.
Conclusion
The pyftpdlib FTPHandler class race condition vulnerability can result in a denial of service, causing temporary outages of FTP servers. It is crucial to upgrade to pyftpdlib version 0.5.1 or later to mitigate this vulnerability. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pyftpdlib →
FAQ
pyftpdlib is a Python FTP server library that allows developers to create custom FTP servers.
The vulnerability is a race condition in the FTPHandler class, which can lead to a denial of service.
The vulnerability can cause a temporary outage of the FTP server, disrupting normal operations.
To fix the vulnerability, upgrade to pyftpdlib version 0.5.1 or later.
No, there is no known workaround. Upgrading to the fixed version is necessary.
Related vulnerabilities
Recent vulnerabilities recorded for pyftpdlib.
