bugtraq - Re: bsdbsdftpd-6.0-ssl-0.6.1-1 attack allows remote users identification

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20030517063206.GA2175@odin.lnet.lut.fi>
Date: Sat, 17 May 2003 09:32:06 +0300
From: Mika Boström <bostik@....fi>
To: NetExpress <netexpress@...cali.it>, bugtraq@...urityfocus.com
Subject: Re: bsdbsdftpd-6.0-ssl-0.6.1-1 attack allows remote users identification

On Fri, 16 May 2003, Damian Gerow wrote:
> Thus spake NetExpress (netexpress@...cali.it) [16/05/03 16:42]:
> > Product bsbsdftpd-6.0-ssl-0.6.1-1 http://bsdftpd-ssl.sc.ru/
> > 
> > During a pen-test we have notice how is easy to identify valid users on
> > vulnerable systems, through a simple timing attack.
> > 
> > When I try to connect to ftp without ssl using a unreal user with bad 
> > password I get
> > immediatly response of incorrect login, when I use real user with bad
> > password I get 2 second of wait before get message of incorrect login.
> > 
> > It seems to be very nice to the recent CAN-2003-0190 about OpenSSH/PAM
> > timing attack allows remote users identification
> > 
> > I have tested this on Linux RH 7.3 and RH 8.0
> 
> I just tried this out on a FreeBSD system (4.8-RC x2), and I get the same
> response time.  Are you sure this is directly related to the ftp daemon, or
> is it a PAM issue?

  Looking back two weeks in BugTraq archives, I see the following
posting:
http://www.securityfocus.com/archive/1/320270/2003-04-30/2003-05-06/0

  This suggests that many more programs are similarly vulnerable,
because they take shortcuts. After all, it is quite common and generally
even good practise to skip redundant code paths. The flipside of the
coin is that it may allow these kind of timing attacks.


-- 
 Mika Boström      +358-50-410-9042  \-/  "The Hell is empty,
 Bostik@....fi    www.lut.fi/~bostik  X    and all the devils
 Security freak, and proud of it.    /-\   are here." -W.S.

Content of type "application/pgp-signature" skipped