ProFTPD 1.2.x, including 1.2.8 and 1.2.10, responds in a different amount of time when a given username exists, which allows remote attackers to identify valid usernames by timing the server response.
References
Link | Resource |
---|---|
http://security.lss.hr/index.php?page=details&ID=LSS-2004-10-02 | Exploit Patch Vendor Advisory |
http://www.securityfocus.com/bid/11430 | Exploit Vendor Advisory |
http://securitytracker.com/id?1011687 | Exploit Patch Vendor Advisory |
http://marc.info/?l=bugtraq&m=109786760926133&w=2 | |
https://exchange.xforce.ibmcloud.com/vulnerabilities/17724 |
Configurations
Configuration 1 (hide)
|
Information
Published : 2004-10-14 21:00
Updated : 2017-07-10 18:31
NVD link : CVE-2004-1602
Mitre link : CVE-2004-1602
JSON object : View
CWE
Products Affected
proftpd_project
- proftpd