||Home : Advisories : ProFTPD mod_sqlpw module password caching bug|
||ProFTPD mod_sqlpw module password caching bug
||12th December 2000
The mod_sqlpw module for ProFTPD caches the user id and password
information returned from the mysql database when attempting to verify a
password. When the "user" command is used to switch to another account,
the cached password is not cleard, and the password entered is checked
against the cached password. If a user knows the password for a valid
account on a ProFTPD system using mod_sqlpw, they may log into any other
account in the database by doing the following:
1. FTP to the host running ProFTPD/mod_sqlpw.
2. At the login prompt, enter the user id of the known account "bob".
3. When prompted for a password, enter an invalid password for the
account "bob". Authentication will fail.
4. Type "user alice", where "alice" is another account in the user
5. When prompted for a password, enter the correct password for "bob".
At this point, the user "bob" is logged in as the user "alice" without
knowing alice's password.