Free and open-source vulnerability scanner

Mageni eases for you the vulnerability scanning, assessment, and management process. It is free and open-source.

Install Now

Available for macOS, Windows, and Linux

App screenshot

pyftpdlib FTP Server Multiple Vulnerabilities

Information

Severity

Severity

High

Family

Family

FTP

CVSSv2 Base

CVSSv2 Base

7.5

CVSSv2 Vector

CVSSv2 Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Solution Type

Solution Type

Vendor Patch

Created

Created

13 years ago

Modified

Modified

5 years ago

Summary

This host is running pyftpdlib FTP server and is prone to multiple vulnerabilities.

Insight

Insight

Multiple flaws exist because pyftpdlib, - allows remote authenticated users to access arbitrary files and directories via a .. (dot dot) in a LIST, STOR, or RETR command. - does not increment the attempted_logins count for a USER command that specifies an invalid username, which makes it easier for remote attackers to obtain access via a brute-force attack. - allows remote attackers to cause a denial of service via a long command. - does not limit the number of attempts to discover a unique filename, which might allow remote authenticated users to cause a denial of service via a STOU command. - does not prevent TCP connections to privileged ports if the destination IP address matches the source IP address of the connection from the FTP client, which might allow remote authenticated users to conduct FTP bounce attacks via crafted FTP data.

Affected Software

Affected Software

ftpserver.py in pyftpdlib before 0.2.0

Solution

Solution

Upgrade to pyftpdlib version 0.5.2 or later.

Common Vulnerabilities and Exposures (CVE)