FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2004-0432

This CVE name corresponds to:

Entered	Topic
2004-05-02	proftpd IP address access control list breakage

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

CVE-2004-0432 at cve.mitre.org

Details

Type	Candidate
Name	CVE-2004-0432
Phase	Assigned(20040503)

Description

ProFTPD 1.2.9 treats the Allow and Deny directives for CIDR based ACL entries as if they were AllowAll, which could allow FTP clients to bypass intended access restrictions.

References

Source	Reference
CONFIRM	http://bugs.proftpd.org/show_bug.cgi?id=2267
MANDRAKE	MDKSA-2004:041
BUGTRAQ	20040430 [OpenPKG-SA-2004.018] OpenPKG Security Advisory (proftpd)
TRUSTIX	2004-0025
BID	10252
SECUNIA	11527
XF	proftpd-cidr-acl-bypass(16038)