full-disclosure - acFTP Authentication Issue

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <200211240637.gAO6bDR07922@pen.homeip.net>
From: jsa at pen.homeip.net (John Andersen)
Subject: acFTP Authentication Issue

On Saturday 23 November 2002 04:58 pm, Matthew Murphy wrote:
> acFTP is an open-source FTP daemon for Windows platforms
> (http://www.sourceforge.net/projects/acftp) that offers more functionality
> than many proprietary servers (including the MS FTP service).  The
> authentication code of acFTP contains a flaw -- specifically, the server
> treats users as logged in without a valid password.  This results in
> mis-representation of server activity in log files, and possibly privilege
> elevation.
>
> For example:
>
> USER private
> PASS #
>
> This leads it to reject my password, but I can not log in with another set
> of credentials, and my log activity appears as "private" instead of the
> appropriate "-" or "***".

Provide a little clarification please.
Can you or can you not access files after giving a bogus password?
Other than a log issue, are you claiming and real exposure or
privledge elevation ?

-- 
_________________________________________________

John Andersen / Juneau Alaska