Re: acFTP Authentication Issue

[John Andersen <jsa () pen homeip net>]

On Saturday 23 November 2002 04:58 pm, Matthew Murphy wrote:
> acFTP is an open-source FTP daemon for Windows platforms
> (http://www.sourceforge.net/projects/acftp) that offers more functionality
> than many proprietary servers (including the MS FTP service).  The
> authentication code of acFTP contains a flaw -- specifically, the server
> treats users as logged in without a valid password.  This results in
> mis-representation of server activity in log files, and possibly privilege
> elevation.
>
> For example:
>
> USER private
> PASS #
>
> This leads it to reject my password, but I can not log in with another set
> of credentials, and my log activity appears as "private" instead of the
> appropriate "-" or "***".

Provide a little clarification please.
Can you or can you not access files after giving a bogus password?
Other than a log issue, are you claiming and real exposure or
privledge elevation ?

-- 
_________________________________________________

John Andersen / Juneau Alaska
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html