OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
From: Matthew Murphy (mattmurphy_at_kc.rr.com)
Date: Sat Nov 23 2002 - 19:57:30 CST

  • Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

    acFTP is an open-source FTP daemon for Windows platforms
    (http://www.sourceforge.net/projects/acftp) that offers more functionality
    than many proprietary servers (including the MS FTP service). The
    authentication code of acFTP contains a flaw -- specifically, the server
    treats users as logged in without a valid password. This results in
    mis-representation of server activity in log files, and possibly privilege
    elevation.

    For example:

    USER private
    PASS #

    This leads it to reject my password, but I can not log in with another set
    of credentials, and my log activity appears as "private" instead of the
    appropriate "-" or "***".