CVE-2009-5011: Race Condition in pyftpdlib
Summary
CVE-2009-5011: Race condition in the FTPHandler class in ftpserver.py in pyftpdlib before 0.5.2 allows remote attackers to cause a denial of service (daemon outage) by establishing and then immediately closing a TCP connection, leading... Affects pyftpdlib versions < 0.5.2. Fixed in 0.5.2. How to fix ↓
Also tracked for
- python-pyftpdlib · Debian:11
The same CVE-2009-5011 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pyftpdlib is a Python FTP server library that provides a high-level interface for implementing FTP servers. It allows developers to create custom FTP servers with ease. The library is widely used in various Python applications that require FTP server functionality.
Vulnerability Detail
The vulnerability, identified as CVE-2009-5011, is a race condition in the FTPHandler class of pyftpdlib before version 0.5.2. This vulnerability allows remote attackers to cause a denial of service (daemon outage) by establishing and immediately closing a TCP connection. This action triggers an ENOTCONN error in the getpeername function, leading to the outage. It is important to note that this vulnerability is different from CVE-2010-3494.
How To Fix
Minimum fixed version
0.5.2
This is the first release that contains the fix.
pip install --upgrade "pyftpdlib==0.5.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version of pyftpdlib to ensure the security and stability of the FTP server implementation.
Conclusion
The race condition vulnerability in pyftpdlib can lead to a denial of service, causing the FTP server to become unresponsive. To mitigate this risk, it is crucial to upgrade to pyftpdlib version 0.5.2 or later. This upgrade includes the necessary fixes to prevent the race condition and ensure the stability and security of the FTP server implementation. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pyftpdlib →
FAQ
The vulnerability can lead to a denial of service, causing the FTP server to become unresponsive and resulting in a service outage.
No, authentication is not required. Remote attackers can trigger the vulnerability by establishing and immediately closing a TCP connection.
There are no known instances of this vulnerability being exploited in the wild.
Yes, this vulnerability can be exploited remotely by sending malicious TCP connection requests to the FTP server.
No, a CVSS score is not available for this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for pyftpdlib.
