[30166] in bugtraq
Re: bsdbsdftpd-6.0-ssl-0.6.1-1 attack allows remote users identification
daemon@ATHENA.MIT.EDU (Damian Gerow)
Sat May 17 02:35:01 2003
Date: Fri, 16 May 2003 16:46:30 -0400
From: Damian Gerow <damian@sentex.net>
To: NetExpress <netexpress@tiscali.it>
Message-ID: <20030516204630.GJ9009@sentex.net>
Mail-Followup-To: NetExpress <netexpress@tiscali.it>,
bugtraq@securityfocus.com
Mime-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha1;
protocol="application/pgp-signature"; boundary="Pk6IbRAofICFmK5e"
Content-Disposition: inline
In-Reply-To: <3EC48C52.7040002@tiscali.it>
--Pk6IbRAofICFmK5e
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
Thus spake NetExpress (netexpress@tiscali.it) [16/05/03 16:42]:
> Product bsbsdftpd-6.0-ssl-0.6.1-1 http://bsdftpd-ssl.sc.ru/
>=20
> During a pen-test we have notice how is easy to identify valid users on
> vulnerable systems, through a simple timing attack.
>=20
> When I try to connect to ftp without ssl using a unreal user with bad=20
> password I get
> immediatly response of incorrect login, when I use real user with bad
> password I get 2 second of wait before get message of incorrect login.
>=20
> It seems to be very nice to the recent CAN-2003-0190 about OpenSSH/PAM
> timing attack allows remote users identification
>=20
> I have tested this on Linux RH 7.3 and RH 8.0
I just tried this out on a FreeBSD system (4.8-RC x2), and I get the same
response time. Are you sure this is directly related to the ftp daemon, or
is it a PAM issue?
--Pk6IbRAofICFmK5e
Content-Type: application/pgp-signature
Content-Disposition: inline
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.2 (FreeBSD)
iD8DBQE+xU4mFz2c9rhB8UIRAlV/AJwJM/R4i35yr6B4dGTbycjisqFbVQCfZqlX
H8lAz1mFvrPwWrLmFNIujAg=
=dZm2
-----END PGP SIGNATURE-----
--Pk6IbRAofICFmK5e--
