The Auth API in ProFTPD before 20070417, when multiple simultaneous authentication modules are configured, does not require that the module that checks authentication is the same as the module that retrieves authentication data, which might allow remote attackers to bypass authentication, as demonstrated by use of SQLAuthTypes Plaintext in mod_sql, with data retrieved from /etc/passwd.

The Auth API in ProFTPD before 20070417, when multiple simultaneous authentication modules are configured, does not require that the module that checks authentication is the same as the module that retrieves authentication data, which might allow remote attackers to bypass authentication, as demonstrated by use of SQLAuthTypes Plaintext in mod_sql, with data retrieved from /etc/passwd.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Auth API in ProFTPD, when multiple simultaneous authentication modules are configured, did not require that the module that checks authentication is the same module that retrieves authentication data, which could possibly be used to allow remote attackers to bypass authentication.

The updated packages have been patched to prevent this issue. As well, this update provides proper PAM configuration files for ProFTPD on Corporate Server 4 that had prevented any mod_auth_pam-based connections from succeeding authentication.

As well, ProFTPD 1.3.0 is being provided for Corporate 3 and Corporate Server 4.

The remote host is running ProFTPd.  Due to a bug in the way the remote server is configured and the way it processes the USER and PASS commands, it is possible to log into the remote system by supplying invalid credentials.

The remote host is using ProFTPD, a free FTP server for Unix and Linux.  According to its banner, the version of ProFTPD installed on the remote host suffers from a flaw where a user can bypass access controls.  An attacker exploiting this flaw would need the ability to authenticate to the server. Successful exploitation would result in the attacker elevating privileges or accessing confidential data.

ID	Name	Product	Family	Severity
27781	Fedora 7 : proftpd-1.3.1-2.fc7 (2007-2613)	Nessus	Fedora Local Security Checks	medium
25565	Mandrake Linux Security Advisory : proftpd (MDKSA-2007:130)	Nessus	Mandriva Local Security Checks	medium
25040	ProFTPD Auth API Multiple Auth Module Authentication Bypass	Nessus	FTP	medium
3970	ProFTPD < 1.3.0rc4 Multiple Modules Authentication Bypass	Nessus Network Monitor	FTP Servers	medium
801029	ProFTPD < 1.3.0rc4 Multiple Modules Authentication Bypass	Log Correlation Engine	FTP Servers	medium

Detections

Analytics

CVE-2007-2165

critical

Tenable Plugins

medium

medium

medium

medium

medium