CVE-2007-6741

Published: Oct 19, 2010Modified: Apr 29, 2026

6.5

Vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Exploitability: 8.0 / Impact: 6.4

Source: NVD

Description

The ftp_PORT function in FTPServer.py in pyftpdlib before 0.2.0 does not prevent TCP connections to privileged ports if the destination IP address matches the source IP address of the connection from the FTP client, which might allow remote authenticated users to conduct FTP bounce attacks via crafted FTP data, as demonstrated by an FTP bounce attack against a NAT server, a related issue to CVE-1999-0017.

Affected (2)

Products: G.rodola: Pyftpdlib

1 product

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
G.rodola Pyftpdlib	Up to 0.1.1
G.rodola Pyftpdlib	Version 0.1

Related CWEs

References (8)

http://code.google.com/p/pyftpdlib/issues/detail?id=11

Source: cve@mitre.org

http://code.google.com/p/pyftpdlib/source/browse/trunk/HISTORY

Source: cve@mitre.org

http://code.google.com/p/pyftpdlib/source/detail?r=32

Source: cve@mitre.org

http://code.google.com/p/pyftpdlib/source/diff?spec=svn32&r=32&format=side&path=/trunk/pyftpdlib/FTPServer.py

Source: cve@mitre.org

http://code.google.com/p/pyftpdlib/issues/detail?id=11

Source: af854a3a-2127-422b-91ae-364da2661108

http://code.google.com/p/pyftpdlib/source/browse/trunk/HISTORY

Source: af854a3a-2127-422b-91ae-364da2661108

http://code.google.com/p/pyftpdlib/source/detail?r=32

Source: af854a3a-2127-422b-91ae-364da2661108

http://code.google.com/p/pyftpdlib/source/diff?spec=svn32&r=32&format=side&path=/trunk/pyftpdlib/FTPServer.py

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.