NVD

Id
54335  
Name
CVE-2007-2165  
Description
The Auth API in ProFTPD before 20070417, when multiple simultaneous authentication modules are configured, does not require that the module that checks authentication is the same as the module that retrieves authentication data, which might allow remote attackers to bypass authentication, as demonstrated by use of SQLAuthTypes Plaintext in mod_sql, with data retrieved from /etc/passwd.  
Reject
 
CVSS Version
2  
CVSS Score
5.1  
Severity
Medium  
CVSS Base Score
5.1  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
4.9  
CVSS Vector
(AV:N/AC:H/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-07  
Published
2007-04-22  
Modified Date
2011-03-07  
Seq
2007-2165  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
275532 54335 CVE-2007-2165 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=419255  View
275533 54335 CVE-2007-2165 http://bugs.proftpd.org/show_bug.cgi?id=2922  View
275534 54335 CVE-2007-2165 1017931  View
275535 54335 CVE-2007-2165 MDKSA-2007:130  View
275536 54335 CVE-2007-2165 23546  View
275537 54335 CVE-2007-2165 ADV-2007-1444  View
275538 54335 CVE-2007-2165 proftpd-authapi-security-bypass(33733)  View
275539 54335 CVE-2007-2165 https://bugzilla.redhat.com/show_bug.cgi?id=237533  View
275540 54335 CVE-2007-2165 FEDORA-2007-2613  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
56746 JVNDB-2007-005438 ProFTPD の Auth API における認証を回避される脆弱性 ProFTPD の Auth API は、同時に複数の認証モジュールが設定されている場合、認証データを検索するモジュールと認証をチェックするモジュールが同一である必要がないため、認証を回避される脆弱性が存在します。 CVE-2007-2165 25520 CVE-2007-2165 54335 5.1 http://jvndb.jvn.jp/ja/contents/2007/JVNDB-2007-005438.html 2007-04-16 2012-12-20 View