CVE-2004-1602: Medium severity ProFTPD ProFTPD vulnerability
ProFTPD 1.2.x, including 1.2.8 and 1.2.10, responds in a different amount of time when a given username exists, which allows remote attackers to identify valid usernames by timing the server response.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2004-1602?
CVE-2004-1602 is classified as a high-severity vulnerability due to its potential to expose valid usernames to attackers.
How does CVE-2004-1602 exploit work?
CVE-2004-1602 exploits an information leakage issue that allows attackers to determine valid usernames by analyzing response times of the ProFTPD server.
How do I fix CVE-2004-1602?
To fix CVE-2004-1602, upgrade to a version of ProFTPD that is later than 1.2.10 where the vulnerability has been patched.
Which versions of ProFTPD are affected by CVE-2004-1602?
CVE-2004-1602 affects ProFTPD versions 1.2.0 through 1.2.10 and their associated pre-release versions.
Is CVE-2004-1602 still a concern in modern environments?
CVE-2004-1602 can still be a concern in environments that have not updated their ProFTPD software, particularly those using outdated versions.