ProFTPD authentication bypass

There is no check data used for authentication is retrieved by the same authentication module if multiple authentication modules are configured...

Mandrake Linux Security Advisory : proftpd (MDKSA-2007:130)

The Auth API in ProFTPD, when multiple simultaneous authentication modules are configured, did not require that the module that checks authentication is the same module that retrieves authentication data, which could possibly be used to allow remote attackers to bypass authentication. The updated...

Debian DSA-1245-1 : proftpd - programming error

Martin Loewer discovered that the proftpd FTP daemon is vulnerable to denial of service if the addon module for Radius authentication is enabled. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisor...

Security fix for the ALT Linux 8 package proftpd version 1.3.0rel-alt2

May 16, 2007 Konstantin Lepikhov 1.3.0rel-alt2 - 1.3.0a stable release. - rollback alt-ltdl patch use alternate variant. - don't delete .la files due ltdlopenext breakage in this case. - remove previous CVE-2006-5815 fixes, use variant from Debian. - change packager. - cleanup obsoleted Conflicts...

CVE-2007-2165

The Auth API in ProFTPD before 20070417, when multiple simultaneous authentication modules are configured, does not require that the module that checks authentication is the same as the module that retrieves authentication data, which might allow remote attackers to bypass authentication, as...

CVE-2007-2165

The Auth API in ProFTPD before 20070417, when multiple simultaneous authentication modules are configured, does not require that the module that checks authentication is the same as the module that retrieves authentication data, which might allow remote attackers to bypass authentication, as...

Authentication flaw

The Auth API in ProFTPD before 20070417, when multiple simultaneous authentication modules are configured, does not require that the module that checks authentication is the same as the module that retrieves authentication data, which might allow remote attackers to bypass authentication, as...

CVE-2007-2165

The Auth API in ProFTPD before 20070417, when multiple simultaneous authentication modules are configured, does not require that the module that checks authentication is the same as the module that retrieves authentication data, which might allow remote attackers to bypass authentication, as...

DEBIAN-CVE-2007-2165

The Auth API in ProFTPD before 20070417, when multiple simultaneous authentication modules are configured, does not require that the module that checks authentication is the same as the module that retrieves authentication data, which might allow remote attackers to bypass authentication, as...

CVE-2007-2165

CVE-2007-2165 affects ProFTPD prior to 20070417. When multiple authentication modules are configured, the authentication-check module need not be the same as the module that retrieves authentication data, potentially allowing remote attackers to bypass authentication (e.g., using SQLAuthTypes Pla...

CVE-2007-2165

The Auth API in ProFTPD before 20070417, when multiple simultaneous authentication modules are configured, does not require that the module that checks authentication is the same as the module that retrieves authentication data, which might allow remote attackers to bypass authentication, as...

CVE-2007-2165

The Auth API in ProFTPD before 20070417, when multiple simultaneous authentication modules are configured, does not require that the module that checks authentication is the same as the module that retrieves authentication data, which might allow remote attackers to bypass authentication, as...

ProFTPD AUTH多个验证模块安全绕过漏洞

proftpd是一款流行的开放源代码的FTP服务程序。 proftpd在AUTH API上存在一个错误，远程攻击者可以利用漏洞可以绕过安全限制，未授权访问。 由于FTP协议需要分开USER和PASS命令，ProFTPD独立的通过USER对用户数据进行检查，而当PASS接收到时对用户的验证进行校验。因此这些组合使ProFTPD允许多个同步Auth模块存在如modauthunix, modsql, modldap，可能导致某个验证模块提供用户数据modauthunix而另一个模块验证用户数据如modsql. 当验证模块modsql配置成使用底限制的验证策略，如： SQLAuthTypes...

ProFTPD Auth API Multiple Auth Module Authentication Bypass

The remote host is running ProFTPd. Due to a bug in the way the remote server is configured and the way it processes the USER and PASS commands, it is possible to log into the remote system by supplying invalid credentials. C Tenable Network Security, Inc. include"compat.inc"; if description...

ProFTPD < 1.3.0rc4 Multiple Modules Authentication Bypass

Binary data 3970.prm...

ProFTPD 1.3.0/1.3.0a (mod_ctrls) Local Overflow Exploit (exec-shield)

No description provided by source. ProFTPD 1.3.0/1.3.0a modctrls Local Overflow Exploit exec-shield http://www.milw0rm.com/sploits/04132007-pr0ftpdmodctrls.tgz...

ProFTPd 1.3.01.3.0a - mod_ctrls exec-shield Local Overflow

ProFTPd 1.3.01.3.0a - modctrls exec-shield Local Overflow ProFTPD 1.3.0/1.3.0a modctrls Local Overflow Exploit exec-shield https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/3730.tgz 04132007-pr0ftpdmodctrls.tgz milw0rm.com 2007-04-13...

ProFTPD 1.3.0/1.3.0a (mod_ctrls) Local Overflow Exploit (exec-shield)

Exploit for linux platform in category local exploits ===================================================================== ProFTPD 1.3.0/1.3.0a modctrls Local Overflow Exploit exec-shield ===================================================================== back:...

ProFTPd 1.3.0/1.3.0a - 'mod_ctrls' exec-shield Local Overflow

ProFTPD 1.3.0/1.3.0a modctrls Local Overflow Exploit exec-shield https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/3730.tgz 04132007-pr0ftpdmodctrls.tgz milw0rm.com 2007-04-13...

ProFTPD 1.3.0/1.3.0a (mod_ctrls support) Local Buffer Overflow Exploit 2

No description provided by source. !/usr/bin/perl -w $Id: revengeproftpdctrls26.pl, v1.1 2007/02/18 19:30:25 revenge Exp $ ProFTPD v1.3.0/1.3.0a Controls Buffer Overflow Exploit Original Advisory : http://www.coresecurity.com/?action=item&id=1594 Exploitation condition ...