Description
The FTP protocol implementation in Mozilla Firefox before 1.5.0.11 and 2.x before 2.0.0.3 allows remote attackers to force the client to connect to other servers, perform a proxied port scan, or obtain sensitive information by specifying an alternate server address in an FTP PASV response.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | devhelp +1 | 0.12-11.el5 | RHSA-2007:0400 |
| RHEL 5 | firefox | 1.5.0.12-1.el5 | RHSA-2007:0400 |
| RHEL 5 | yelp | 2.16.0-15.el5 | RHSA-2007:0400 |
| RHEL 4 | devhelp +1 | 0.10-0.8.el4 | RHSA-2007:0402 |
| RHEL 4 | firefox | 1.5.0.12-0.1.el4 | RHSA-2007:0400 |
| RHEL 4 | seamonkey +5 | 1.0.9-2.el4 | RHSA-2007:0402 |
| RHEL 3 | seamonkey +9 | 1.0.9-0.1.el3 | RHSA-2007:0402 |
| RHEL 2 | seamonkey +9 | 1.0.9-0.1.el2 | RHSA-2007:0402 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- Mozilla FireFox 1.5.x/2.0 - FTP PASV Port-Scanning EDB-29768 · remote · Mar 21, 2007 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 2
- RHSA-2007:0400 Red Hat Security Advisory: firefox security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2007:0402 Red Hat Security Advisory: seamonkey security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- USN-443-1 vendor-advisory
- 20070531 FLEA-2007-0023-1: firefox mailing-list
- firefox-nsftpstate-information-disclosure(33119) vdb-entry
- HPSBUX02153 vendor-advisory
- 1017800 vdb-entry
- SUSE-SA:2007:036 vendor-advisory
- RHSA-2007:0400 vendor-advisory
- 20070322 FLEA-2007-0001-1: firefox mailing-list
- ADV-2007-1034 vdb-entry
- http://bindshell.net/papers/ftppasv/ftp-client-pasv-manipulation.pdf
- 23082 vdb-entry
- https://issues.rpath.com/browse/RPL-1424
- 25858 third-party-advisory
- 25476 third-party-advisory
- http://www.mozilla.org/security/announce/2007/mfsa2007-11.html
- oval:org.mitre.oval:def:11431 vdb-entry signature
- https://bugzilla.mozilla.org/show_bug.cgi?id=370559
- 25490 third-party-advisory
- RHSA-2007:0402 vendor-advisory
- https://issues.rpath.com/browse/RPL-1157
- [oss-security] 20201209 [SECURITY ADVISORY] curl: trusting FTP PASV responses mailing-list