Python FTP server library (pyftpdlib) 'ftpserver.py' File Multiple Security Vulnerabilities

Bugtraq ID:	44298
Class:	Unknown
CVE:	CVE-2009-5010 CVE-2009-5011 CVE-2009-5012 CVE-2009-5013
Remote:	Yes
Local:	No
Published:	Feb 27 2009 12:00AM
Updated:	Apr 13 2015 09:56PM
Credit:	Giampaolo Rodola, bneijt, billiej.
Vulnerable:
Not Vulnerable:

Python FTP server library (pyftpdlib) 'ftpserver.py' File Multiple Security Vulnerabilities

Python FTP server library (pyftpdlib) is prone to a security-bypass vulnerability and multiple remote denial-of-service vulnerabilities.

An attacker can exploit these issues to cause a denial of service condition, or to bypass certain security restrictions and gain unauthorized access.

Versions prior to pyftpdlib 0.5.2 are vulnerable.

Python FTP server library (pyftpdlib) 'ftpserver.py' File Multiple Security Vulnerabilities

Attackers can use readily available network utilities to exploit these issues.

Python FTP server library (pyftpdlib) 'ftpserver.py' File Multiple Security Vulnerabilities

Solution:
Updates are available. Please see the references for more information.

Python FTP server library (pyftpdlib) 'ftpserver.py' File Multiple Security Vulnerabilities

References:

• CVE Request -- Python -- accept() implementation in async core is broken => mor (Openwall)
  
• Issue 114: "l" permission should be valid also for MLST command (Google)
  
• pyftpdlib Changelog (Google)
  
• Python FTP server library (pyftpdlib) Project Page (Google)