Description
The Auth API in ProFTPD before 20070417, when multiple simultaneous authentication modules are configured, does not require that the module that checks authentication is the same as the module that retrieves authentication data, which might allow remote attackers to bypass authentication, as demonstrated by use of SQLAuthTypes Plaintext in mod_sql, with data retrieved from /etc/passwd.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | proftpd-dfsg | 1.3.0-24 | — |
| Debian 13 | proftpd-dfsg | 1.3.0-24 | — |
| Debian 12 | proftpd-dfsg | 1.3.0-24 | — |
References
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=419255
- http://bugs.proftpd.org/show_bug.cgi?id=2922
- https://bugzilla.redhat.com/show_bug.cgi?id=237533
- MDKSA-2007:130 vendor-advisory
- 25724 third-party-advisory
- 23546 vdb-entry
- 24867 third-party-advisory
- 34602 vdb-entry
- ADV-2007-1444 vdb-entry
- 1017931 vdb-entry
- FEDORA-2007-2613 vendor-advisory
- 27516 third-party-advisory
- proftpd-authapi-security-bypass(33733) vdb-entry