CVE-2015-7665 Information disclosure in n/a
Remote FTP servers can discover the Tor client IP address due to automatic fallback from passive to active FTP in Tails OS.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2015-7665?
CVE-2015-7665 is a medium-severity vulnerability in n/a, published on 27 Dec 2015. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Tails before 1.7 includes the wget program but does not prevent automatic fallback from passive FTP to active FTP, which allows remote FTP servers to discover the Tor client IP address by reading a (1) PORT or (2) EPRT command. NOTE: within wget itself, the automatic fallback is not considered a vulnerability by CVE.
Weakness: CWE-200
Which versions are affected by CVE-2015-7665?
It affects 1 product.
Products include Tails Project Tails.
How do I fix CVE-2015-7665?
Upgrade to a fixed version.
Is CVE-2015-7665 being exploited?
There is no known exploitation of CVE-2015-7665 in the wild and no public exploit code.
Sources
Also known as GHSA-mp83-q9h6-ghgh.