Vulnerabilities > CVE-2007-2165 - Authentication Module Security Bypass vulnerability in ProFTPD AUTH
Attack vector
NETWORK Attack complexity
HIGH Privileges required
NONE Confidentiality impact
PARTIAL Integrity impact
PARTIAL Availability impact
PARTIAL Summary
The Auth API in ProFTPD before 20070417, when multiple simultaneous authentication modules are configured, does not require that the module that checks authentication is the same as the module that retrieves authentication data, which might allow remote attackers to bypass authentication, as demonstrated by use of SQLAuthTypes Plaintext in mod_sql, with data retrieved from /etc/passwd.
Vulnerable Configurations
Part | Description | Count |
---|---|---|
Application | 1 |
Nessus
NASL family Mandriva Local Security Checks NASL id MANDRAKE_MDKSA-2007-130.NASL description The Auth API in ProFTPD, when multiple simultaneous authentication modules are configured, did not require that the module that checks authentication is the same module that retrieves authentication data, which could possibly be used to allow remote attackers to bypass authentication. The updated packages have been patched to prevent this issue. As well, this update provides proper PAM configuration files for ProFTPD on Corporate Server 4 that had prevented any mod_auth_pam-based connections from succeeding authentication. As well, ProFTPD 1.3.0 is being provided for Corporate 3 and Corporate Server 4. last seen 2020-06-01 modified 2020-06-02 plugin id 25565 published 2007-06-21 reporter This script is Copyright (C) 2007-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/25565 title Mandrake Linux Security Advisory : proftpd (MDKSA-2007:130) code #%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Mandrake Linux Security Advisory MDKSA-2007:130. # The text itself is copyright (C) Mandriva S.A. # include("compat.inc"); if (description) { script_id(25565); script_version ("1.15"); script_cvs_date("Date: 2019/08/02 13:32:49"); script_cve_id("CVE-2007-2165"); script_xref(name:"MDKSA", value:"2007:130"); script_name(english:"Mandrake Linux Security Advisory : proftpd (MDKSA-2007:130)"); script_summary(english:"Checks rpm output for the updated packages"); script_set_attribute( attribute:"synopsis", value: "The remote Mandrake Linux host is missing one or more security updates." ); script_set_attribute( attribute:"description", value: "The Auth API in ProFTPD, when multiple simultaneous authentication modules are configured, did not require that the module that checks authentication is the same module that retrieves authentication data, which could possibly be used to allow remote attackers to bypass authentication. The updated packages have been patched to prevent this issue. As well, this update provides proper PAM configuration files for ProFTPD on Corporate Server 4 that had prevented any mod_auth_pam-based connections from succeeding authentication. As well, ProFTPD 1.3.0 is being provided for Corporate 3 and Corporate Server 4." ); script_set_attribute(attribute:"solution", value:"Update the affected packages."); script_set_cvss_base_vector("CVSS2#AV:N/AC:H/Au:N/C:P/I:P/A:P"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:proftpd"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:proftpd-anonymous"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:proftpd-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:proftpd-mod_autohost"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:proftpd-mod_ban"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:proftpd-mod_case"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:proftpd-mod_clamav"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:proftpd-mod_ctrls_admin"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:proftpd-mod_facl"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:proftpd-mod_gss"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:proftpd-mod_ifsession"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:proftpd-mod_ldap"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:proftpd-mod_load"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:proftpd-mod_quotatab"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:proftpd-mod_quotatab_file"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:proftpd-mod_quotatab_ldap"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:proftpd-mod_quotatab_radius"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:proftpd-mod_quotatab_sql"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:proftpd-mod_radius"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:proftpd-mod_ratio"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:proftpd-mod_rewrite"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:proftpd-mod_shaper"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:proftpd-mod_site_misc"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:proftpd-mod_sql"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:proftpd-mod_sql_mysql"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:proftpd-mod_sql_postgres"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:proftpd-mod_time"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:proftpd-mod_tls"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:proftpd-mod_wrap"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:proftpd-mod_wrap_file"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:proftpd-mod_wrap_sql"); script_set_attribute(attribute:"cpe", value:"cpe:/o:mandriva:linux:2007"); script_set_attribute(attribute:"cpe", value:"cpe:/o:mandriva:linux:2007.1"); script_set_attribute(attribute:"patch_publication_date", value:"2007/06/20"); script_set_attribute(attribute:"plugin_publication_date", value:"2007/06/21"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2007-2019 Tenable Network Security, Inc."); script_family(english:"Mandriva Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/Mandrake/release", "Host/Mandrake/rpm-list"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); if (!get_kb_item("Host/Mandrake/release")) audit(AUDIT_OS_NOT, "Mandriva / Mandake Linux"); if (!get_kb_item("Host/Mandrake/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if (cpu !~ "^(amd64|i[3-6]86|x86_64)$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Mandriva / Mandrake Linux", cpu); flag = 0; if (rpm_check(release:"MDK2007.0", reference:"proftpd-1.3.0-4.5mdv2007.0", yank:"mdv")) flag++; if (rpm_check(release:"MDK2007.0", reference:"proftpd-anonymous-1.3.0-4.5mdv2007.0", yank:"mdv")) flag++; if (rpm_check(release:"MDK2007.0", reference:"proftpd-mod_autohost-1.3.0-4.5mdv2007.0", yank:"mdv")) flag++; if (rpm_check(release:"MDK2007.0", reference:"proftpd-mod_case-1.3.0-4.5mdv2007.0", yank:"mdv")) flag++; if (rpm_check(release:"MDK2007.0", reference:"proftpd-mod_clamav-1.3.0-4.5mdv2007.0", yank:"mdv")) flag++; if (rpm_check(release:"MDK2007.0", reference:"proftpd-mod_ctrls_admin-1.3.0-4.5mdv2007.0", yank:"mdv")) flag++; if (rpm_check(release:"MDK2007.0", reference:"proftpd-mod_facl-1.3.0-4.5mdv2007.0", yank:"mdv")) flag++; if (rpm_check(release:"MDK2007.0", reference:"proftpd-mod_gss-1.3.0-4.5mdv2007.0", yank:"mdv")) flag++; if (rpm_check(release:"MDK2007.0", reference:"proftpd-mod_ifsession-1.3.0-4.5mdv2007.0", yank:"mdv")) flag++; if (rpm_check(release:"MDK2007.0", reference:"proftpd-mod_ldap-1.3.0-4.5mdv2007.0", yank:"mdv")) flag++; if (rpm_check(release:"MDK2007.0", reference:"proftpd-mod_load-1.3.0-4.5mdv2007.0", yank:"mdv")) flag++; if (rpm_check(release:"MDK2007.0", reference:"proftpd-mod_quotatab-1.3.0-4.5mdv2007.0", yank:"mdv")) flag++; if (rpm_check(release:"MDK2007.0", reference:"proftpd-mod_quotatab_file-1.3.0-4.5mdv2007.0", yank:"mdv")) flag++; if (rpm_check(release:"MDK2007.0", reference:"proftpd-mod_quotatab_ldap-1.3.0-4.5mdv2007.0", yank:"mdv")) flag++; if (rpm_check(release:"MDK2007.0", reference:"proftpd-mod_quotatab_sql-1.3.0-4.5mdv2007.0", yank:"mdv")) flag++; if (rpm_check(release:"MDK2007.0", reference:"proftpd-mod_radius-1.3.0-4.5mdv2007.0", yank:"mdv")) flag++; if (rpm_check(release:"MDK2007.0", reference:"proftpd-mod_ratio-1.3.0-4.5mdv2007.0", yank:"mdv")) flag++; if (rpm_check(release:"MDK2007.0", reference:"proftpd-mod_rewrite-1.3.0-4.5mdv2007.0", yank:"mdv")) flag++; if (rpm_check(release:"MDK2007.0", reference:"proftpd-mod_shaper-1.3.0-4.5mdv2007.0", yank:"mdv")) flag++; if (rpm_check(release:"MDK2007.0", reference:"proftpd-mod_site_misc-1.3.0-4.5mdv2007.0", yank:"mdv")) flag++; if (rpm_check(release:"MDK2007.0", reference:"proftpd-mod_sql-1.3.0-4.5mdv2007.0", yank:"mdv")) flag++; if (rpm_check(release:"MDK2007.0", reference:"proftpd-mod_sql_mysql-1.3.0-4.5mdv2007.0", yank:"mdv")) flag++; if (rpm_check(release:"MDK2007.0", reference:"proftpd-mod_sql_postgres-1.3.0-4.5mdv2007.0", yank:"mdv")) flag++; if (rpm_check(release:"MDK2007.0", reference:"proftpd-mod_time-1.3.0-4.5mdv2007.0", yank:"mdv")) flag++; if (rpm_check(release:"MDK2007.0", reference:"proftpd-mod_tls-1.3.0-4.5mdv2007.0", yank:"mdv")) flag++; if (rpm_check(release:"MDK2007.0", reference:"proftpd-mod_wrap-1.3.0-4.5mdv2007.0", yank:"mdv")) flag++; if (rpm_check(release:"MDK2007.0", reference:"proftpd-mod_wrap_file-1.3.0-4.5mdv2007.0", yank:"mdv")) flag++; if (rpm_check(release:"MDK2007.0", reference:"proftpd-mod_wrap_sql-1.3.0-4.5mdv2007.0", yank:"mdv")) flag++; if (rpm_check(release:"MDK2007.1", reference:"proftpd-1.3.1-0.rc2.3.2mdv2007.1", yank:"mdv")) flag++; if (rpm_check(release:"MDK2007.1", reference:"proftpd-devel-1.3.1-0.rc2.3.2mdv2007.1", yank:"mdv")) flag++; if (rpm_check(release:"MDK2007.1", reference:"proftpd-mod_autohost-1.3.1-0.rc2.3.2mdv2007.1", yank:"mdv")) flag++; if (rpm_check(release:"MDK2007.1", reference:"proftpd-mod_ban-1.3.1-0.rc2.3.2mdv2007.1", yank:"mdv")) flag++; if (rpm_check(release:"MDK2007.1", reference:"proftpd-mod_case-1.3.1-0.rc2.3.2mdv2007.1", yank:"mdv")) flag++; if (rpm_check(release:"MDK2007.1", reference:"proftpd-mod_clamav-1.3.1-0.rc2.3.2mdv2007.1", yank:"mdv")) flag++; if (rpm_check(release:"MDK2007.1", reference:"proftpd-mod_ctrls_admin-1.3.1-0.rc2.3.2mdv2007.1", yank:"mdv")) flag++; if (rpm_check(release:"MDK2007.1", reference:"proftpd-mod_gss-1.3.1-0.rc2.3.2mdv2007.1", yank:"mdv")) flag++; if (rpm_check(release:"MDK2007.1", reference:"proftpd-mod_ifsession-1.3.1-0.rc2.3.2mdv2007.1", yank:"mdv")) flag++; if (rpm_check(release:"MDK2007.1", reference:"proftpd-mod_ldap-1.3.1-0.rc2.3.2mdv2007.1", yank:"mdv")) flag++; if (rpm_check(release:"MDK2007.1", reference:"proftpd-mod_load-1.3.1-0.rc2.3.2mdv2007.1", yank:"mdv")) flag++; if (rpm_check(release:"MDK2007.1", reference:"proftpd-mod_quotatab-1.3.1-0.rc2.3.2mdv2007.1", yank:"mdv")) flag++; if (rpm_check(release:"MDK2007.1", reference:"proftpd-mod_quotatab_file-1.3.1-0.rc2.3.2mdv2007.1", yank:"mdv")) flag++; if (rpm_check(release:"MDK2007.1", reference:"proftpd-mod_quotatab_ldap-1.3.1-0.rc2.3.2mdv2007.1", yank:"mdv")) flag++; if (rpm_check(release:"MDK2007.1", reference:"proftpd-mod_quotatab_radius-1.3.1-0.rc2.3.2mdv2007.1", yank:"mdv")) flag++; if (rpm_check(release:"MDK2007.1", reference:"proftpd-mod_quotatab_sql-1.3.1-0.rc2.3.2mdv2007.1", yank:"mdv")) flag++; if (rpm_check(release:"MDK2007.1", reference:"proftpd-mod_radius-1.3.1-0.rc2.3.2mdv2007.1", yank:"mdv")) flag++; if (rpm_check(release:"MDK2007.1", reference:"proftpd-mod_ratio-1.3.1-0.rc2.3.2mdv2007.1", yank:"mdv")) flag++; if (rpm_check(release:"MDK2007.1", reference:"proftpd-mod_rewrite-1.3.1-0.rc2.3.2mdv2007.1", yank:"mdv")) flag++; if (rpm_check(release:"MDK2007.1", reference:"proftpd-mod_shaper-1.3.1-0.rc2.3.2mdv2007.1", yank:"mdv")) flag++; if (rpm_check(release:"MDK2007.1", reference:"proftpd-mod_site_misc-1.3.1-0.rc2.3.2mdv2007.1", yank:"mdv")) flag++; if (rpm_check(release:"MDK2007.1", reference:"proftpd-mod_sql-1.3.1-0.rc2.3.2mdv2007.1", yank:"mdv")) flag++; if (rpm_check(release:"MDK2007.1", reference:"proftpd-mod_sql_mysql-1.3.1-0.rc2.3.2mdv2007.1", yank:"mdv")) flag++; if (rpm_check(release:"MDK2007.1", reference:"proftpd-mod_sql_postgres-1.3.1-0.rc2.3.2mdv2007.1", yank:"mdv")) flag++; if (rpm_check(release:"MDK2007.1", reference:"proftpd-mod_time-1.3.1-0.rc2.3.2mdv2007.1", yank:"mdv")) flag++; if (rpm_check(release:"MDK2007.1", reference:"proftpd-mod_tls-1.3.1-0.rc2.3.2mdv2007.1", yank:"mdv")) flag++; if (rpm_check(release:"MDK2007.1", reference:"proftpd-mod_wrap-1.3.1-0.rc2.3.2mdv2007.1", yank:"mdv")) flag++; if (rpm_check(release:"MDK2007.1", reference:"proftpd-mod_wrap_file-1.3.1-0.rc2.3.2mdv2007.1", yank:"mdv")) flag++; if (rpm_check(release:"MDK2007.1", reference:"proftpd-mod_wrap_sql-1.3.1-0.rc2.3.2mdv2007.1", yank:"mdv")) flag++; if (flag) { if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get()); else security_warning(0); exit(0); } else audit(AUDIT_HOST_NOT, "affected");
NASL family FTP NASL id PROFTPD_AUTH_BYPASS.NASL description The remote host is running ProFTPd. Due to a bug in the way the remote server is configured and the way it processes the USER and PASS commands, it is possible to log into the remote system by supplying invalid credentials. last seen 2020-06-01 modified 2020-06-02 plugin id 25040 published 2007-04-19 reporter This script is Copyright (C) 2007-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/25040 title ProFTPD Auth API Multiple Auth Module Authentication Bypass NASL family Fedora Local Security Checks NASL id FEDORA_2007-2613.NASL description The Auth API in ProFTPD before 20070417, when multiple simultaneous authentication modules are configured, does not require that the module that checks authentication is the same as the module that retrieves authentication data, which might allow remote attackers to bypass authentication, as demonstrated by use of SQLAuthTypes Plaintext in mod_sql, with data retrieved from /etc/passwd. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 27781 published 2007-11-06 reporter This script is Copyright (C) 2007-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/27781 title Fedora 7 : proftpd-1.3.1-2.fc7 (2007-2613)
References
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=419255
- http://bugs.proftpd.org/show_bug.cgi?id=2922
- http://osvdb.org/34602
- http://secunia.com/advisories/24867
- http://secunia.com/advisories/25724
- http://secunia.com/advisories/27516
- http://securitytracker.com/id?1017931
- http://www.mandriva.com/security/advisories?name=MDKSA-2007:130
- http://www.securityfocus.com/bid/23546
- http://www.vupen.com/english/advisories/2007/1444
- https://bugzilla.redhat.com/show_bug.cgi?id=237533
- https://exchange.xforce.ibmcloud.com/vulnerabilities/33733
- https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00065.html