ProFTPD 1.2.x - Username Enumeration via Timing Attack

mediumseverity

5CVSS score

30.7%likelihood of exploitation, next 30 days

98%of all CVEs are less likely

Readycheck to confirm it

ProFTPD versions 1.2.x (including 1.2.8 and 1.2.10) are vulnerable to timing attacks that allow remote attackers to distinguish valid usernames from invalid ones. The server responds in varying amounts of time when a given username exists, enabling username enumeration through response time analysis.

Impact

Attackers can enumerate valid usernames by analyzing server response times, facilitating subsequent brute force or targeted attacks against ProFTPD authentication.

Fix

Upgrade ProFTPD to a version later than 1.2.10 that normalizes response times for authentication attempts regardless of username validity.

How to confirm it

Send: tcp probe to {{Hostname}}
Positive when: contains(raw, 'ProFTPD') and compare_versions(version, '>= 1.2.0', '<= 1.2.10')

Run it with nuclei: nuclei -id CVE-2004-1602 -u <target>

The full check

id: CVE-2004-1602

info:
  name: ProFTPD 1.2.x - Username Enumeration via Timing Attack
  author: pussycat0x
  severity: medium
  description: |
    ProFTPD versions 1.2.x (including 1.2.8 and 1.2.10) are vulnerable to timing attacks that allow remote attackers to distinguish valid usernames from invalid ones. The server responds in varying amounts of time when a given username exists, enabling username enumeration through response time analysis.
  impact: |
    Attackers can enumerate valid usernames by analyzing server response times, facilitating subsequent brute force or targeted attacks against ProFTPD authentication.
  remediation: |
    Upgrade ProFTPD to a version later than 1.2.10 that normalizes response times for authentication attempts regardless of username validity.
  reference:
    - http://marc.info/?l=bugtraq&m=109786760926133&w=2
    - https://exchange.xforce.ibmcloud.com/vulnerabilities/17724
  classification:
    cvss-metrics: CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N
    cvss-score: 5
    cve-id: CVE-2004-1602
    cwe-id: CWE-203
    epss-score: 0.30679
    epss-percentile: 0.98261
    cpe: cpe:2.3:a:proftpd:proftpd:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: proftpd
    product: proftpd
    shodan-query:
      - product:"proftpd"
      - cpe:"cpe:2.3:a:proftpd:proftpd"
  tags: cve,cve2004,network,ftp,proftpd,tcp,passive,timing-attack,user-enum,vuln

tcp:
  - inputs:
      - data: 00000000
        type: hex

    host:
      - "{{Hostname}}"

    port: 21
    read-size: 1024

    matchers:
      - type: dsl
        dsl:
          - "contains(raw, 'ProFTPD')"
          - "compare_versions(version, '>= 1.2.0', '<= 1.2.10')"
        condition: and

    extractors:
      - type: regex
        group: 1
        name: version
        regex:
          - "ProFTPD ([0-9.]+)"

References

Use this check only on systems you are authorised to test. Where the data comes from