CVE-2007-6741

NameCVE-2007-6741
DescriptionThe ftp_PORT function in FTPServer.py in pyftpdlib before 0.2.0 does not prevent TCP connections to privileged ports if the destination IP address matches the source IP address of the connection from the FTP client, which might allow remote authenticated users to conduct FTP bounce attacks via crafted FTP data, as demonstrated by an FTP bounce attack against a NAT server, a related issue to CVE-1999-0017.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
python-pyftpdlib (PTS)buster1.5.4-1fixed
bullseye1.5.4-2fixed
bookworm1.5.7-3fixed
sid, trixie1.5.9-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
python-pyftpdlibsource(unstable)(not affected)

Notes

- python-pyftpdlib <not-affected> (Fixed before initial upload to the archive)

Search for package or bug name: Reporting problems