Timing Attack on ProFTPD Server by The ProFTPD Project

CVE-2004-1602

What is CVE-2004-1602?

ProFTPD versions 1.2.8 and 1.2.10 are susceptible to a timing attack, where the server's response time varies based on whether a given username exists. This behavior allows remote attackers to exploit this time difference to enumerate valid usernames on the server. By analyzing the response times, attackers can effectively determine the legitimacy of usernames, posing a significant risk to the security and privacy of users.

References