CVE-2007-6740: pyftpdlib - Allocation of Resources Without Limits
Summary
CVE-2007-6740: pyftpdlib vulnerable to allocation of resources without limits. Affects pyftpdlib versions < 0.2.0. Fixed in 0.2.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pyftpdlib is a Python FTP server library that provides a high-level interface for implementing FTP servers. It allows developers to create custom FTP servers with ease. The library is widely used in various Python projects and provides functionality for handling FTP commands, managing user authentication, and handling file transfers. However, pyftpdlib versions prior to 0.2.0 are vulnerable to an issue that allows remote authenticated users to cause a denial of service (DoS) attack through a specific FTP command.
Vulnerability Detail
The vulnerability in pyftpdlib lies in the ftp_STOU function in FTPServer.py. This function does not limit the number of attempts to discover a unique filename when processing the STOU (Store Unique) command. As a result, a remote authenticated user can repeatedly send STOU commands with different filenames, causing the server to exhaust its resources and eventually crash. This vulnerability can be exploited by an attacker with valid FTP credentials, leading to a DoS condition and disrupting the availability of the FTP server.
How To Fix
Minimum fixed version
0.2.0
This is the first release that contains the fix.
pip install --upgrade "pyftpdlib==0.2.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is strongly advised to upgrade to the fixed version of pyftpdlib as soon as possible.
Conclusion
pyftpdlib versions prior to 0.2.0 are vulnerable to an allocation of resources without limits issue. This vulnerability can be exploited by remote authenticated users to cause a denial of service attack on the FTP server. To mitigate this vulnerability, it is crucial to upgrade to pyftpdlib version 0.2.0 or later. For further assistance and support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pyftpdlib →
FAQ
pyftpdlib is a Python FTP server library that allows developers to create custom FTP servers.
The vulnerability in pyftpdlib allows remote authenticated users to cause a denial of service (DoS) attack through a specific FTP command.
The vulnerability can lead to a DoS condition, causing the FTP server to become unavailable and disrupting file transfer operations.
To fix this vulnerability, upgrade to pyftpdlib version 0.2.0 or later.
There is no known workaround for this vulnerability. It is recommended to upgrade to the fixed version of pyftpdlib.
Related vulnerabilities
Recent vulnerabilities recorded for pyftpdlib.
