Launchpad.net

CVE 2007-6263

The dataconn function in ftpd.c in netkit ftpd (netkit-ftpd) 0.17, when certain modifications to support SSL have been introduced, calls fclose on an uninitialized file stream, which allows remote attackers to cause a denial of service (daemon crash) and possibly have unspecified other impact via some types of FTP over SSL protocol behavior, as demonstrated by breaking a passive FTP DATA connection in a way that triggers an error in the server's SSL_accept function. NOTE: the netkit ftp issue is covered by CVE-2007-5769.

Related bugs and status

CVE-2007-6263 (Candidate) is related to these bugs:

Bug #176175: CVE-2007-6263: security vulnerability in linux-ftpd-ssl

		In	Importance	Status
176175	CVE-2007-6263: security vulnerability in linux-ftpd-ssl	linux-ftpd-ssl (Ubuntu)	Wishlist	Fix Released
176175	CVE-2007-6263: security vulnerability in linux-ftpd-ssl	linux-ftpd-ssl (Ubuntu Dapper)	Medium	Won't Fix
176175	CVE-2007-6263: security vulnerability in linux-ftpd-ssl	linux-ftpd-ssl (Ubuntu Edgy)	Medium	Won't Fix
176175	CVE-2007-6263: security vulnerability in linux-ftpd-ssl	linux-ftpd-ssl (Ubuntu Gutsy)	Medium	Won't Fix
176175	CVE-2007-6263: security vulnerability in linux-ftpd-ssl	linux-ftpd-ssl (Ubuntu Feisty)	Medium	Won't Fix
176175	CVE-2007-6263: security vulnerability in linux-ftpd-ssl	linux-ftpd-ssl (Ubuntu Hardy)	Wishlist	Fix Released

See the

CVE page on Mitre.org for more details.

References

MISC: http://bugs.gentoo.org...
GENTOO: GLSA-200801-17
SECUNIA: 28697
OSVDB: 41191
BID: 26763
FULLDISC: 20071207 netkit-ftpd/f...