PT-2004-2510 · Proftpd · Proftpd

Published 2004-10-15 · Updated 2024-02-15 · CVE-2004-1602

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions ProFTPD versions 1.2.x through 1.2.10 ProFTPD versions prior to 1.2.11

Description The issue allows remote attackers to identify valid usernames by timing the server response, as the server responds in a different amount of time when a given username exists. This can assist a remote user in enumerating usernames, determining what usernames are valid, privileged, or do not exist on the remote system.

Recommendations For ProFTPD versions 1.2.x through 1.2.10, update to version 1.2.11 or later. For ProFTPD versions prior to 1.2.11, update to version 1.2.11 or later.

Exploit

Fix

Side Channel Attack

Weakness Enumeration

CWE-203

Related Identifiers

CVE-2004-1602

Affected Products

Proftpd

References · 9

• 🔥 http://securityfocus.com/bid/11430 · Exploit
• 🔥 https://exploit-db.com/exploits/581 · Exploit
• 🔥 http://security.lss.hr/index.php?page=details&ID=LSS-2004-10-02 · Exploit
• 🔥 http://securitytracker.com/id?1011687 · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1602 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2004-1602 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17724 · Note
• http://marc.info/?l=bugtraq&m=109786760926133&w=2 · Note
• https://t.me/cvenotify/71620 · Telegram Post