CVE-2007-6741

The ftp_PORT function in FTPServer.py in pyftpdlib before 0.2.0 does not prevent TCP connections to privileged ports if the destination IP address matches the source IP address of the connection from the FTP client, which might allow remote authenticated users to conduct FTP bounce attacks via crafted FTP data, as demonstrated by an FTP bounce attack against a NAT server, a related issue to CVE-1999-0017.

CVSS v2.0 6.5 MEDIUM

6.5^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:P/I:P/A:P

Exploitability : 8.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://code.google.com/p/pyftpdlib/source/detail?r=32
http://code.google.com/p/pyftpdlib/source/browse/trunk/HISTORY
http://code.google.com/p/pyftpdlib/issues/detail?id=11
http://code.google.com/p/pyftpdlib/source/diff?spec=svn32&r=32&format=side&path=/trunk/pyftpdlib/FTPServer.py

Advertisement

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:g.rodola:pyftpdlib:0.1:::::::*
	cpe:2.3:a:g.rodola:pyftpdlib::::::::

Information

Published : 2010-10-19 13:00

Updated : 2010-10-19 21:00

NVD link : CVE-2007-6741

Mitre link : CVE-2007-6741

JSON object : View

CWE

CWE-264

Permissions, Privileges, and Access Controls

Advertisement

Products Affected

g.rodola

pyftpdlib

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://code.google.com/p/pyftpdlib/source/detail?r=32", "name": "http://code.google.com/p/pyftpdlib/source/detail?r=32", "tags": [], "refsource": "CONFIRM"}, {"url": "http://code.google.com/p/pyftpdlib/source/browse/trunk/HISTORY", "name": "http://code.google.com/p/pyftpdlib/source/browse/trunk/HISTORY", "tags": [], "refsource": "CONFIRM"}, {"url": "http://code.google.com/p/pyftpdlib/issues/detail?id=11", "name": "http://code.google.com/p/pyftpdlib/issues/detail?id=11", "tags": [], "refsource": "CONFIRM"}, {"url": "http://code.google.com/p/pyftpdlib/source/diff?spec=svn32&r=32&format=side&path=/trunk/pyftpdlib/FTPServer.py", "name": "http://code.google.com/p/pyftpdlib/source/diff?spec=svn32&r=32&format=side&path=/trunk/pyftpdlib/FTPServer.py", "tags": [], "refsource": "CONFIRM"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "The ftp_PORT function in FTPServer.py in pyftpdlib before 0.2.0 does not prevent TCP connections to privileged ports if the destination IP address matches the source IP address of the connection from the FTP client, which might allow remote authenticated users to conduct FTP bounce attacks via crafted FTP data, as demonstrated by an FTP bounce attack against a NAT server, a related issue to CVE-1999-0017."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-264"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2007-6741", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 6.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "severity": "MEDIUM", "impactScore": 6.4, "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2010-10-19T20:00Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:g.rodola:pyftpdlib:0.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:g.rodola:pyftpdlib:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "0.1.1"}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2010-10-20T04:00Z"}