Authentication Bypass in ProFTPD Server by The Vendor ProFTPD
CVE-2007-2165
Currently unrated
What is CVE-2007-2165?
In ProFTPD versions prior to 20070417, a vulnerability exists within the authentication API that can be exploited when multiple simultaneous authentication modules are configured. This flaw permits attackers to bypass the authentication mechanism by utilizing different modules for checking authentication versus retrieving authentication data. For instance, an attacker could leverage SQLAuthTypes Plaintext in mod_sql while pulling user data from /etc/passwd, compromising server security. This vulnerability emphasizes the importance of ensuring that authentication checks align with the respective data retrieval methods to safeguard against unauthorized access.