Bug 11558 - ProFTPD Auth API Multiple Authentication Modules Security Issue
: ProFTPD Auth API Multiple Authentication Modules Security Issue
Status: CLOSED FIXED
: Sisyphus
(All bugs in Sisyphus/proftpd)
: unstable
: all Linux
: P2 normal
Assigned To:
:
: http://bugs.proftpd.org/show_bug.cgi?...
:
:
:
  Show dependency tree
 
Reported: 2007-04-18 15:13 by
Modified: 2008-02-28 15:41 (History)


Attachments


Note

You need to log in before you can comment on or make changes to this bug.


Description From 2007-04-18 15:13:03
SOFTWARE:
ProFTPD 1.3.x
http://secunia.com/product/5430/
ProFTPD 1.2.x
http://secunia.com/product/1250/

DESCRIPTION:
A security issue has been reported in ProFTPD, which potentially can
be exploited by malicious people to bypass certain security
restrictions.

The security issue is caused due to an error within ProFTPD's Auth
API. If multiple authentication modules are used, it is possible that
one module provides data, which is then authenticated against another
module. This can e.g. be exploited to bypass certain security
restrictions if authentication modules are configured with different
policies.

SOLUTION:
Fixed in the CVS repository.

PROVIDED AND/OR DISCOVERED BY:
Evgeni Golov

ORIGINAL ADVISORY:
ProFTPD:
http://bugs.proftpd.org/show_bug.cgi?id=2922

Debian:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=419255
------- Comment #1 From 2007-05-16 15:33:52 -------
Fixed in proftpd-1.3.0rel-alt2.