Mandriva Linux Security Advisory – The Auth API in ProFTPD, when multiple simultaneous authentication modules are configured, did not require that the module that checks authentication is the same module that retrieves authentication data, which could possibly be used to allow remote attackers to bypass authentication. The updated packages have been patched to prevent this issue. As well, this update provides proper PAM configuration files for ProFTPD on Corporate Server 4 that had prevented any mod_auth_pam-based connections from succeeding authentication.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/57267/MDKSA-2007-130.txt
Source: https://packetstormsecurity.com/files/57267/Mandriva-Linux-Security-Advisory-2007.130.html