diff --git a/curl-7.17.1-badsocket.patch b/curl-7.17.1-badsocket.patch
new file mode 100644
index 0000000..7f092ae
--- /dev/null
+++ b/curl-7.17.1-badsocket.patch
@@ -0,0 +1,13 @@
+diff -up curl-7.17.1/lib/ftp.c.badsocket curl-7.17.1/lib/ftp.c
+--- curl-7.17.1/lib/ftp.c.badsocket	2007-10-27 00:25:19.000000000 +0200
++++ curl-7.17.1/lib/ftp.c	2008-01-08 15:09:03.000000000 +0100
+@@ -3228,7 +3228,8 @@ static CURLcode Curl_ftp_done(struct con
+     /* Note that we keep "use" set to TRUE since that (next) connection is
+        still requested to use SSL */
+   }
+-  sclose(conn->sock[SECONDARYSOCKET]);
++  if(CURL_SOCKET_BAD != conn->sock[SECONDARYSOCKET])
++    sclose(conn->sock[SECONDARYSOCKET]);
+ 
+   conn->sock[SECONDARYSOCKET] = CURL_SOCKET_BAD;
+ 
diff --git a/curl.spec b/curl.spec
index d8fbf99..8176a6a 100644
--- a/curl.spec
+++ b/curl.spec
@@ -1,7 +1,7 @@
 Summary: A utility for getting files from remote servers (FTP, HTTP, and others)
 Name: curl 
 Version: 7.17.1
-Release: 4%{?dist}
+Release: 5%{?dist}
 License: MIT
 Group: Applications/Internet
 Source: http://curl.haxx.se/download/%{name}-%{version}.tar.bz2
@@ -9,6 +9,7 @@ Patch1: curl-7.15.3-multilib.patch
 Patch2: curl-7.16.0-privlibs.patch
 Patch3: curl-7.16.4-curl-config.patch
 Patch4: curl-7.17.1-sslgen.patch
+Patch5: curl-7.17.1-badsocket.patch
 Provides: webclient
 URL: http://curl.haxx.se/
 BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
@@ -50,6 +51,7 @@ use cURL's capabilities internally.
 %patch2 -p1 -b .privlibs
 %patch3 -p1 -b .curl-config
 %patch4 -p1 -b .sslgen
+%patch5 -p1 -b .badsocket
 
 %build
 export CPPFLAGS="$(pkg-config --cflags nss) -DHAVE_PK11_CREATEGENERICOBJECT"
@@ -106,6 +108,10 @@ rm -rf $RPM_BUILD_ROOT
 %{_datadir}/aclocal/libcurl.m4
 
 %changelog
+* Tue Jan  8 2008 Jindrich Novy <jnovy@redhat.com> 7.17.1-5
+- do not attempt to close a bad socket (#427966),
+  thanks to Caolam McNamara
+
 * Tue Dec  4 2007 Jindrich Novy <jnovy@redhat.com> 7.17.1-4
 - rebuild because of the openldap soname bump
 - remove old nsspem patch