SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (File Transfer/Sharing)  >   ProFTPD Vendors:   ProFTPd
ProFTPd Login Timing Differences Disclose Valid User Account Names to Remote Users
SecurityTracker Alert ID:  1011687
SecurityTracker URL:  http://securitytracker.com/id/1011687
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  Oct 14 2004
Impact:   Disclosure of user information
Exploit Included:  Yes  
Version(s): 1.2.8, 1.2.10; possibly other versions
Description:   A vulnerability was reported in ProFTPd. A remote user can determine valid user account names on the target FTP server.

LSS Security Team reported that a remote user can determine valid user account names using a code execution path timing analysis attack against the ProFTPd login procedure.

The report indicates that there is a very small, but still significant, difference in the amount of time required to process valid usernames versus invalid usernames. A remote user can measure the elapsed time between the transmission of the 'USER' command and the receipt of the server response. Then, based on the different response times, the remote user can determine which requested user account names are valid.

Demonstration exploit code is available at:

http://security.lss.hr/PoC

Leon Juranic is credited with discovering this flaw.

The original advisory is available at:

http://security.lss.hr/index.php?page=details&ID=LSS-2004-10-02

Impact:   A remote user can determine valid user account names on the target FTP server.
Solution:   No solution was available at the time of this entry.

The author of the report has provided the following unofficial patch:

proftpd-1.2.10/modules/mod_auth.c

1867a1868,1877

> {
> unsigned int randa;
> struct timeval tv;
> struct timezone tz;
> gettimeofday (&tv, &tz);
> srand(tv.tv_usec);
> randa = rand() % 20000;
> usleep(randa);
> }
>

Vendor URL:  www.proftpd.org/ (Links to External Site)
Cause:   Randomization error, State error
Underlying OS:  Linux (Any), UNIX (Any)

Message History:   None.


 Source Message Contents



[Original Message Not Available for Viewing]


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2021, SecurityGlobal.net LLC