CVE-2007-2165

    Dashboard / Vulnerabilities / CVE-2007-2165

    CVE-2007-2165

    Published: 22 Apr 2007Last Modified: 10 Apr 2026

    Summary:

    Details: The Auth API in ProFTPD before 20070417, when multiple simultaneous authentication modules are configured, does not require that the module that checks authentication is the same as the module that retrieves authentication data, which might allow remote attackers to bypass authentication, as demonstrated by use of SQLAuthTypes Plaintext in mod_sql, with data retrieved from /etc/passwd.

    References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=419255, http://secunia.com/advisories/24867, http://secunia.com/advisories/25724, http://secunia.com/advisories/27516, http://securitytracker.com/id?1017931, http://www.mandriva.com/security/advisories?name=MDKSA-2007:130, http://www.vupen.com/english/advisories/2007/1444, http://bugs.proftpd.org/show_bug.cgi?id=2922, https://bugzilla.redhat.com/show_bug.cgi?id=237533, http://osvdb.org/34602, http://www.securityfocus.com/bid/23546, https://exchange.xforce.ibmcloud.com/vulnerabilities/33733, https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00065.html

    Affected packages

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High