Home page logo

bugtraq logo Bugtraq mailing list archives

Re: bsdbsdftpd-6.0-ssl-0.6.1-1 attack allows remote users identification
From: Damian Gerow <damian () sentex net>
Date: Fri, 16 May 2003 16:46:30 -0400

Thus spake NetExpress (netexpress () tiscali it) [16/05/03 16:42]:
Product bsbsdftpd-6.0-ssl-0.6.1-1 http://bsdftpd-ssl.sc.ru/

During a pen-test we have notice how is easy to identify valid users on
vulnerable systems, through a simple timing attack.

When I try to connect to ftp without ssl using a unreal user with bad 
password I get
immediatly response of incorrect login, when I use real user with bad
password I get 2 second of wait before get message of incorrect login.

It seems to be very nice to the recent CAN-2003-0190 about OpenSSH/PAM
timing attack allows remote users identification

I have tested this on Linux RH 7.3 and RH 8.0

I just tried this out on a FreeBSD system (4.8-RC x2), and I get the same
response time.  Are you sure this is directly related to the ftp daemon, or
is it a PAM issue?

Attachment: _bin

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]