ProFTPD 1.2.x, including 1.2.8 and 1.2.10, responds in a different amount of time when a given username exists, which allows remote attackers to identify valid usernames by timing the server response.

A heap-based buffer overflow flaw was found in the way ProFTPD FTP server prepared SQL queries for certain usernames, when the modsql module was enabled. A remote, unauthenticated attacker could use this flaw to cause proftpd daemon to crash or, potentially, to execute arbitrary code with the privileges of the user running 'proftpd' via a specially-crafted username, provided in the authentication dialog.

Upstream bug report: [1] http://bugs.proftpd.org/showbug.cgi?id=3536

References: [2] http://www.securityfocus.com/bid/44933 [3] http://phrack.org/issues.html?issue=67&id=7#article [4] http://bugs.gentoo.org/showbug.cgi?id=348998 [5] http://proftpd.org/docs/RELEASENOTES-1.3.3d (ProFTPD v1.3.3d release notes)

CVE identifier: [6] http://www.openwall.com/lists/oss-security/2011/01/14/6