bugtraq - Re: bsdbsdftpd-6.0-ssl-0.6.1-1 attack allows remote users identification

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20030516204630.GJ9009@sentex.net>
Date: Fri, 16 May 2003 16:46:30 -0400
From: Damian Gerow <damian@...tex.net>
To: NetExpress <netexpress@...cali.it>
Subject: Re: bsdbsdftpd-6.0-ssl-0.6.1-1 attack allows remote users identification

Thus spake NetExpress (netexpress@...cali.it) [16/05/03 16:42]:
> Product bsbsdftpd-6.0-ssl-0.6.1-1 http://bsdftpd-ssl.sc.ru/
> 
> During a pen-test we have notice how is easy to identify valid users on
> vulnerable systems, through a simple timing attack.
> 
> When I try to connect to ftp without ssl using a unreal user with bad 
> password I get
> immediatly response of incorrect login, when I use real user with bad
> password I get 2 second of wait before get message of incorrect login.
> 
> It seems to be very nice to the recent CAN-2003-0190 about OpenSSH/PAM
> timing attack allows remote users identification
> 
> I have tested this on Linux RH 7.3 and RH 8.0

I just tried this out on a FreeBSD system (4.8-RC x2), and I get the same
response time.  Are you sure this is directly related to the ftp daemon, or
is it a PAM issue?

Content of type "application/pgp-signature" skipped