bugtraq - bsdbsdftpd-6.0-ssl-0.6.1-1 attack allows remote users identification

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Fri, 16 May 2003 08:59:30 +0200
From: NetExpress <netexpress@...cali.it>
To: Pen-Test@...urityfocus.com, bugtraq@...urityfocus.com
Subject: bsdbsdftpd-6.0-ssl-0.6.1-1 attack allows remote users identification


Product bsbsdftpd-6.0-ssl-0.6.1-1 http://bsdftpd-ssl.sc.ru/

During a pen-test we have notice how is easy to identify valid users on
vulnerable systems, through a simple timing attack.

When I try to connect to ftp without ssl using a unreal user with bad 
password I get
immediatly response of incorrect login, when I use real user with bad
password I get 2 second of wait before get message of incorrect login.

It seems to be very nice to the recent CAN-2003-0190 about OpenSSH/PAM
timing attack allows remote users identification

I have tested this on Linux RH 7.3 and RH 8.0

I belive the vulnerability is easy to exploit and may have high
severity, if combined with poor password policies and other security
problems that allow local privilege escalation.


Alessandro Fiorenzi

a.fiorenzi@...ogroup.it aka netexpress

*------------------------------------------------------------------------
INFOGROUP S.P.A                 http://www.infogroup.it

-------------------------------------------------------------------------
DR. FIORENZI ALESSANDRO *

Consulente Tribunale Firenze - sicurezza informatica -
System Administrator
Socio CLUSIT <file:///home/fiore/signature/www.clusit.it>, ALSI 
<file:///home/fiore/signature/www.alsi.it>


Tel : +39.055.43.65.742
CE : +39.335.64.144.77
@Email : a.fiorenzi@...ogroup.it
PGP Key: http://www.infogroup.it/ds/fiorenzi.asc

/-------------------------------------------------------------------------
            *"Faber est suae quisque fortunae" *
-------------------------------------------------------------------------/

//