ProFTPd Login Timing Differences Disclose Valid User Account Names to Remote Users
|
|
SecurityTracker Alert ID: 1011687 |
|
SecurityTracker URL: http://securitytracker.com/id/1011687
|
|
CVE Reference:
GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Oct 14 2004
|
Impact:
Disclosure of user information
|
Exploit Included: Yes
|
Version(s): 1.2.8, 1.2.10; possibly other versions
|
Description:
A vulnerability was reported in ProFTPd. A remote user can determine valid user account names on the target FTP server.
LSS Security Team reported that a remote user can determine valid user account names using a code execution path timing analysis attack against the ProFTPd login procedure.
The report indicates that there is a very small, but still significant, difference in the amount of time required to process valid usernames versus invalid usernames. A remote user can measure the elapsed time between the transmission of the 'USER' command and the receipt of the server response. Then, based on the different response times, the remote user can determine which requested user account names are valid.
Demonstration exploit code is available at:
http://security.lss.hr/PoC
Leon Juranic is credited with discovering this flaw.
The original advisory is available at:
http://security.lss.hr/index.php?page=details&ID=LSS-2004-10-02
|
Impact:
A remote user can determine valid user account names on the target FTP server.
|
Solution:
No solution was available at the time of this entry.
The author of the report has provided the following unofficial patch:
proftpd-1.2.10/modules/mod_auth.c
1867a1868,1877
> {
> unsigned int randa;
> struct timeval tv;
> struct timezone tz;
> gettimeofday (&tv, &tz);
> srand(tv.tv_usec);
> randa = rand() % 20000;
> usleep(randa);
> }
>
|
Vendor URL: www.proftpd.org/ (Links to External Site)
|
Cause:
Randomization error, State error
|
Underlying OS:
Linux (Any), UNIX (Any)
|
|
Message History:
None.
|
Source Message Contents
|
Date: Thu, 14 Oct 2004 10:49:49 -0400
Subject: http://security.lss.hr/index.php?page=details&ID=LSS-2004-10-02
|
LSS Security Team reported that a remote user can determine valid user account
names using a code execution path timing analysis attack against the ProFTPd login
procedure.
The report indicates that there is a very small, but still significant, difference
in the amount of time required to process valid usernames versus invalid usernames.
A remote user can measure the elapsed time between the transmission of the 'USER'
command and the receipt of the server response.
Versions 1.2.8 and 1.2.10 and possibly other versions are affected.
Demonstration exploit code is available at:
http://security.lss.hr/PoC
Leon Juranic is credited with discovering this flaw.
The author of the report has provided the following unofficial patch:
proftpd-1.2.10/modules/mod_auth.c
1867a1868,1877
> {
> unsigned int randa;
> struct timeval tv;
> struct timezone tz;
> gettimeofday (&tv, &tz);
> srand(tv.tv_usec);
> randa = rand() % 20000;
> usleep(randa);
> }
>
|
|
