Bug 29487

Summary: ftpd leaks password typed as username by mistake
Product: Base System Reporter: Yoshihiro Koya <Yoshihiro.Koya>
Component: binAssignee: Yar Tikhiy <yar>
Status: Closed FIXED    
Severity: Affects Only Me    
Priority: Normal    
Version: 4.4-PRERELEASE   
Hardware: Any   
OS: Any   
Attachments:
Description Flags
file.diff none

Description Yoshihiro Koya 2001-08-06 14:50:01 UTC 
It might quite often to type the password instead of username 
to ftp clients by mistake.
In that case, ftpd(8) on FreeBSD logges the usenames into
/var/log/messages as follows

	Aug  6 22:19:28 presario ftpd[814]: FTP LOGIN FAILED FROM localhost, mypass 

On the other hand, evey user on the system can access /var/log/messages.
It might cause security related problems.

How-To-Repeat: 	Type your password as a username to ftp.
	And check your /var/log/messages.
Comment 1 mheffner 2001-08-07 02:38:28 UTC 
On 06-Aug-2001 Yoshihiro Koya wrote:
| 
| It might quite often to type the password instead of username 
| to ftp clients by mistake.
| In that case, ftpd(8) on FreeBSD logges the usenames into
| /var/log/messages as follows

But this information is sometimes relevant if you would like to be able to tell
the difference between an attacker probing several different accounts and a
normal user mistyping their username.

| 
|       Aug  6 22:19:28 presario ftpd[814]: FTP LOGIN FAILED FROM localhost,
mypass 
| 
| On the other hand, evey user on the system can access /var/log/messages.
| It might cause security related problems. 

A better way might be to log the username info to a different facility, auth,
authpriv or something that's not logged to a world readable file.

Mike

-- 
  Mike Heffner         <mheffner@[acm.]vt.edu>
  Fredericksburg, VA       <mikeh@FreeBSD.org>
Comment 2 Yoshihiro Koya 2001-08-08 06:40:45 UTC 
Hello,

From: Mike Heffner <mheffner@novacoxmail.com>
Subject: RE: bin/29487: ftpd leaks password typed as username by mistake
Date: Mon, 06 Aug 2001 21:38:28 -0400 (EDT)
Message-ID: <XFMail.20010806213828.mheffner@novacoxmail.com>

> On 06-Aug-2001 Yoshihiro Koya wrote:
> | 
> | It might quite often to type the password instead of username 
> | to ftp clients by mistake.
> | In that case, ftpd(8) on FreeBSD logges the usenames into
> | /var/log/messages as follows
> 
> But this information is sometimes relevant if you would like to be able to tell
> the difference between an attacker probing several different accounts and a
> normal user mistyping their username.

Yes. I agree with you. But, I thought at that time that the defect 
that ftpd may leak the password is more harmful than the defect that
I'm not able to distinguish the deference between  mistype and attacks.

> | 
> |       Aug  6 22:19:28 presario ftpd[814]: FTP LOGIN FAILED FROM localhost,
> mypass 
> | 
> | On the other hand, evey user on the system can access /var/log/messages.
> | It might cause security related problems. 
> 
> A better way might be to log the username info to a different facility, auth,
> authpriv or something that's not logged to a world readable file.

I agree with you again. I think that your suggestion might be a 
better one. 

koya
Comment 3 ashp freebsd_committer freebsd_triage 2002-01-18 02:57:16 UTC 
State Changed
From-To: open->analyzed

While nobody has decided to commit this patch, the issue is potentially 
of issue to a junior hacker.  Therefore this patch gets moved to analyzed, 
rather than suspended.
Comment 4 ashp freebsd_committer freebsd_triage 2002-01-21 15:13:32 UTC 
State Changed
From-To: analyzed->suspended

Sheldon feels this is better filed as suspended.
Comment 5 Yar Tikhiy freebsd_committer freebsd_triage 2003-02-11 12:38:40 UTC 
State Changed
From-To: suspended->patched

Since no junior hacker had arised to deal with this problem, 
a somewhat older one decided to peek at it. 

Fixed in CURRENT in the way login(1) had been using since the beginning. 
Thanks!
Comment 6 Yar Tikhiy freebsd_committer freebsd_triage 2003-02-11 12:43:19 UTC 
Responsible Changed
From-To: freebsd-bugs->yar

MFC reminder.
Comment 7 Yar Tikhiy freebsd_committer freebsd_triage 2003-02-14 12:43:12 UTC 
State Changed
From-To: patched->closed

STABLE ftpd(8) now logs bad usernames to LOG_AUTHPRIV, as does CURRENT one.