Bugtraq mailing list archives
Re: bsdbsdftpd-6.0-ssl-0.6.1-1 attack allows remote users identification
From: NetExpress <netexpress () tiscali it>
Date: Fri, 16 May 2003 23:47:14 +0200
Damian Gerow wrote:
You are right, is the same preoblem has affected OpenSSH/PAM timing attack about which Marco Ivald from MediaService has post the bug and the solution.Thus spake NetExpress (netexpress () tiscali it) [16/05/03 16:42]:Product bsbsdftpd-6.0-ssl-0.6.1-1 http://bsdftpd-ssl.sc.ru/ During a pen-test we have notice how is easy to identify valid users on vulnerable systems, through a simple timing attack.When I try to connect to ftp without ssl using a unreal user with bad password I getimmediatly response of incorrect login, when I use real user with bad password I get 2 second of wait before get message of incorrect login. It seems to be very nice to the recent CAN-2003-0190 about OpenSSH/PAM timing attack allows remote users identification I have tested this on Linux RH 7.3 and RH 8.0I just tried this out on a FreeBSD system (4.8-RC x2), and I get the same response time. Are you sure this is directly related to the ftp daemon, or is it a PAM issue?
I have been in touch with Marco Ivaldi, he has found that is the same kind of problem, an the same soltion, but is not really goot to get this problem on the default installation . I mailed to the author but I get no response
For the solution follow the same present on http://lab.mediaservice.net/advisory/2003-01-openssh.txt
Alessandro Fiorenzi
Current thread:
- bsdbsdftpd-6.0-ssl-0.6.1-1 attack allows remote users identification NetExpress (May 16)
- Re: bsdbsdftpd-6.0-ssl-0.6.1-1 attack allows remote users identification Damian Gerow (May 16)
- Re: bsdbsdftpd-6.0-ssl-0.6.1-1 attack allows remote users identification NetExpress (May 16)
- Re: bsdbsdftpd-6.0-ssl-0.6.1-1 attack allows remote users identification Mika Boström (May 17)
- Re: bsdbsdftpd-6.0-ssl-0.6.1-1 attack allows remote users identification Damian Gerow (May 16)