CVE-2009-5012: PYSEC-2010-9 - ftpserver.py in pyftpdlib before 0.5.2 does not require the l permission for the MLST command, which allows remote authenticated users to by

CVE-2009-5012 · Severity: medium · CVSS 4 · Published 2010-10-19

Technologies: pyftpdlib (PyPI). Vendors: PyPI.

Executive brief

ftpserver.py in pyftpdlib before 0.5.2 does not require the l permission for the MLST command, which allows remote authenticated users to bypass intended access restrictions and list the root directory via an FTP session.

Affected products

PyPI pyftpdlib

Related threats

PYSEC-2010-22 - pyftpdlib before 0.1.1 does not choose a random value for the port associated with the PASV command, which makes it easier for remote attack
PYSEC-2010-21 - FTPServer.py in pyftpdlib before 0.2.0 does not increment the attempted_logins count for a USER command that specifies an invalid username
PYSEC-2010-4 - Multiple directory traversal vulnerabilities in FTPServer.py in pyftpdlib before 0.3.0 allow remote authenticated users to access arbitrary
PYSEC-2010-23 - FTPServer.py in pyftpdlib before 0.2.0 allows remote attackers to cause a denial of service via a long command.
PYSEC-2010-25 - The ftp_PORT function in FTPServer.py in pyftpdlib before 0.2.0 does not prevent TCP connections to privileged ports if the destination IP a