PT-2004-2510 · Proftpd · Proftpd

CVE-2004-1602 · Publicado 2004-10-15 · Atualizado 2024-02-15

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions ProFTPD versions 1.2.x through 1.2.10 ProFTPD versions prior to 1.2.11

Description The issue allows remote attackers to identify valid usernames by timing the server response, as the server responds in a different amount of time when a given username exists. This can assist a remote user in enumerating usernames, determining what usernames are valid, privileged, or do not exist on the remote system.

Recommendations For ProFTPD versions 1.2.x through 1.2.10, update to version 1.2.11 or later. For ProFTPD versions prior to 1.2.11, update to version 1.2.11 or later.

Exploit

Correção

Side Channel Attack

Enumeração de Fraquezas

CWE-203

Identificadores relacionados

CVE-2004-1602

Produtos afetados

Proftpd

Referências · 9

• 🔥 http://securityfocus.com/bid/11430 · Exploit
• 🔥 https://exploit-db.com/exploits/581 · Exploit
• 🔥 http://security.lss.hr/index.php?page=details&ID=LSS-2004-10-02 · Exploit
• 🔥 http://securitytracker.com/id?1011687 · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1602 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17724 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2004-1602 · Nota de Segurança
• http://marc.info/?l=bugtraq&m=109786760926133&w=2 · Nota
• https://t.me/cvenotify/71620 · Publicação no Telegram