CVE-2007-6737

2022-10-0316:14:29

Debian Security Bug Tracker

security-tracker.debian.org

ftpserver.py

pyftpdlib

invalid username

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

0.006

Percentile

79.5%

JSON

FTPServer.py in pyftpdlib before 0.2.0 does not increment the attempted_logins count for a USER command that specifies an invalid username, which makes it easier for remote attackers to obtain access via a brute-force attack.

OSVersionArchitecturePackageVersionFilename
Debian12allpython-pyftpdlib< 1.5.7-3python-pyftpdlib_1.5.7-3_all.deb
Debian11allpython-pyftpdlib< 1.5.4-2python-pyftpdlib_1.5.4-2_all.deb
Debian999allpython-pyftpdlib< 1.5.9-2python-pyftpdlib_1.5.9-2_all.deb
Debian13allpython-pyftpdlib< 1.5.9-2python-pyftpdlib_1.5.9-2_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	python-pyftpdlib	< 1.5.7-3	python-pyftpdlib_1.5.7-3_all.deb
Debian	11	all	python-pyftpdlib	< 1.5.4-2	python-pyftpdlib_1.5.4-2_all.deb
Debian	999	all	python-pyftpdlib	< 1.5.9-2	python-pyftpdlib_1.5.9-2_all.deb
Debian	13	all	python-pyftpdlib	< 1.5.9-2	python-pyftpdlib_1.5.9-2_all.deb