CVE-2007-2165

The record

The Auth API in ProFTPD before 20070417, when multiple simultaneous authentication modules are configured, does not require that the module that checks authentication is the same as the module that retrieves authentication data, which might allow remote attackers to bypass authentication, as demonstrated by use of SQLAuthTypes Plaintext in mod_sql, with data retrieved from /etc/passwd.

Affected packages

Related vulnerabilities

• CVE-2011-4130 Use-after-free vulnerability in the Response API in ProFTPD before 1.3.3g allows remote… Also affects proftpd-dfsg
• CVE-2009-0543 ProFTPD Server 1.3.1, with NLS support enabled, allows remote attackers to bypass SQL… Also affects proftpd-dfsg
• CVE-2009-0542 SQL injection vulnerability in ProFTPD Server 1.3.1 through 1.3.2rc2 allows remote… Also affects proftpd-dfsg
• CVE-2006-6170 Buffer overflow in the tls_x509_name_oneline function in the mod_tls module, as used in… Also affects proftpd-dfsg
• CVE-2006-5815 Stack-based buffer overflow in the sreplace function in ProFTPD 1.3.0 and earlier allows… Also affects proftpd-dfsg
• CVE-2005-4816 Buffer overflow in mod_radius in ProFTPD before 1.3.0rc2 allows remote attackers to cause… Also affects proftpd-dfsg
• CVE-2024-48651 In ProFTPD through 1.3.8b before cec01cc, supplemental group inheritance grants… Also affects proftpd-dfsg
• CVE-2015-3306 The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to… Also affects proftpd-dfsg