[18026] in bugtraq
mod_sqlpw Password Caching Bug
daemon@ATHENA.MIT.EDU (Miller)
Tue Dec 12 16:26:18 2000
Mime-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Message-Id: <Pine.GSO.4.30.0012111453200.15854-100000@clark.net>
Date: Mon, 11 Dec 2000 14:55:48 -0500
Reply-To: Miller <joemiler@CLARK.NET>
From: Miller <joemiler@CLARK.NET>
X-To: bugtraq@securityfocus.net
To: BUGTRAQ@SECURITYFOCUS.COM
The mod_sqlpw module for ProFTPD caches the user id and password
information returned from the mysql database when attempting to verify a
password. When the "user" command is used to switch to another account,
the cached password is not cleard, and the password entered is checked
against the cached password. If a user knows the password for a valid
account on a ProFTPD system using mod_sqlpw, they may log into any other
account in the database by doing the following:
1. FTP to the host running ProFTPD/mod_sqlpw.
2. At the login prompt, enter the user id of the known account "bob".
3. When prompted for a password, enter an invalid password for the
account "bob". Authentication will fail.
4. Type "user alice", where "alice" is another account in the user
database.
5. When prompted for a password, enter the correct password for "bob".
At this point, the user "bob" is logged in as the user "alice" without
knowing alice's password.
Joe Miller
