CVE-2008-7264: Input Validation
Published Oct 19, 2010
·Updated
The ftpQUIT function in ftpserver.py in pyftpdlib before 0.5.0 allows remote authenticated users to cause a denial of service (file descriptor exhaustion and daemon outage) by sending a QUIT command during a disallowed data-transfer attempt.
Affected Software
6 affected componentsFixes available
pip/pyftpdlib<0.5.0
0.5.0
G.rodola Pyftpdlib<=0.4.0
G.rodola Pyftpdlib=0.1
G.rodola Pyftpdlib=0.1.1
G.rodola Pyftpdlib=0.2.0
G.rodola Pyftpdlib=0.3.0
Remediation
Patch Available
Event History
Oct 19, 2010
CVE Published
via MITRE·07:00 PM
Data Sourced
via MITRE·07:00 PM
Description
May 17, 2022
Advisory Published
via GitHub·05:47 AM
Frequently Asked Questions
1
What is the severity of CVE-2008-7264?
CVE-2008-7264 has been classified as a denial of service vulnerability.
2
How do I fix CVE-2008-7264?
To fix CVE-2008-7264, upgrade pyftpdlib to version 0.5.0 or later.
3
What causes the CVE-2008-7264 vulnerability?
The vulnerability is caused by remote authenticated users sending a QUIT command during disallowed data-transfer attempts, resulting in file descriptor exhaustion.
4
Which versions of pyftpdlib are affected by CVE-2008-7264?
Versions of pyftpdlib before 0.5.0 are affected by CVE-2008-7264.
5
Can CVE-2008-7264 be exploited remotely?
Yes, CVE-2008-7264 can be exploited by remote authenticated users.