CVE-2021-40491

What it actually does

The FTP client fails to validate that the IP address returned in PASV/LPSV responses matches the original server address, allowing a malicious or compromised server (or MITM) to redirect subsequent data connections to an arbitrary endpoint controlled by the attacker.

Why it matters to the business

Systems relying on the affected FTP client for file transfers risk unintended data exposure or leakage to attacker-controlled hosts, increasing exposure in legacy automation, embedded devices, or environments where FTP remains in use.

How an attack unfolds

An attacker either hosts a malicious FTP server or intercepts legitimate FTP traffic; when the client issues a data transfer command, the server replies with a PASV response containing an attacker-chosen address; the client then opens a data connection to that address, allowing the attacker to receive or inject file contents.

How to fix it

Upgrade inetutils to the fixed versions listed for each distribution: Debian 11 to 2:2.0-1+deb11u1 or later, Debian 12/13 to 2:2.2-1 or later, and the upstream git commit 58cb043b190fd04effdaea7c9403416b436e50dd. Replace any custom builds or embedded copies with patched releases.

How to confirm the fix worked

Verify installed package versions against the fixed releases above; test that PASV responses containing mismatched addresses are rejected by the client; review build logs or package manifests for the vulnerable pre-2.2 inetutils ftp binary.

Typical attack path

1. Attacker places a malicious FTP server or performs traffic interception
2. Victim client initiates an FTP session and requests a data transfer
3. Server returns a crafted PASV/LPSV response pointing to attacker IP/port
4. Client opens data connection to the supplied address
5. File contents are transferred to or from the attacker-controlled endpoint

How to detect it

Search system and application logs for ftp client invocations that resulted in data connections to unexpected external IPs; review network flow records for FTP data-channel sessions whose destination IP differs from the control-channel server IP; examine package history for pre-2.2 inetutils installations.

What your security team should do

• Prioritize upgrade of inetutils packages on all Debian-based systems still running pre-2.2 releases
• Audit scripts, containers, and appliances that invoke the inetutils ftp client and replace with a validated client (e.g., curl, wget, or modern ftp utilities)
• Add package version checks to vulnerability scanning and configuration management pipelines
• Monitor for any remaining legacy FTP usage and migrate to SFTP or FTPS where feasible