CVE-2007-6263 Null dereference in n/a
Remote attackers can crash the netkit ftpd daemon via uninitialized file stream handling in SSL-enabled passive FTP connections.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2007-6263?
CVE-2007-6263 is a critical vulnerability in n/a, published on 6 Dec 2007. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The dataconn function in ftpd.c in netkit ftpd (netkit-ftpd) 0.17, when certain modifications to support SSL have been introduced, calls fclose on an uninitialized file stream, which allows remote attackers to cause a denial of service (daemon crash) and possibly have unspecified other impact via some types of FTP over SSL protocol behavior, as demonstrated by breaking a passive FTP DATA connection in a way that triggers an error in the server's SSL_accept function. NOTE: the netkit ftp issue is covered by CVE-2007-5769.
Weakness: CWE-20
Which versions are affected by CVE-2007-6263?
It affects 1 product.
Products include Netkit-Ftp Netkit Ftp.
How do I fix CVE-2007-6263?
Apply the vendor's patch.
Is CVE-2007-6263 being exploited?
There is no known exploitation of CVE-2007-6263 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as DEBIAN-CVE-2007-6263, GHSA-xch5-xh5p-whc7.