Miggo Logo

CVE-2007-6740: pyftpdlib vulnerable to allocation of resources without limits

6.5

CVSS Score
3.1

Basic Information

EPSS Score
0.65606%
Published
5/1/2022
Updated
10/21/2024
KEV Status
No
Technology
TechnologyPython

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
pyftpdlibpip< 0.2.00.2.0

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The CVE description explicitly names ftp_STOU in FTPServer.py as the vulnerable function. The vulnerability stems from an unlimited retry loop for filename generation, confirmed by: 1) The GitHub advisory's description of infinite attempts 2) The original issue #25 discussing the lack of max attempts 3) Historical references to r=37 commit modifying STOU logic 4) CWE-770 classification matching unbounded resource allocation patterns. The function's role in handling STOU commands and generating unique filenames makes it the clear entry point for this DoS vector.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

T** *tp_STOU *un*tion in *TPS*rv*r.py in py*tp*li* ***or* *.*.* *o*s not limit t** num**r o* *tt*mpts to *is*ov*r * uniqu* *il*n*m*, w*i** mi**t *llow r*mot* *ut**nti**t** us*rs to **us* * **ni*l o* s*rvi** vi* * STOU *omm*n*.

Reasoning

T** *V* **s*ription *xpli*itly n*m*s `*tp_STOU` in `*TPS*rv*r.py` *s t** vuln*r**l* *un*tion. T** vuln*r**ility st*ms *rom *n unlimit** r*try loop *or `*il*n*m*` **n*r*tion, *on*irm** *y: *) T** *it*u* **visory's **s*ription o* in*init* *tt*mpts *) T