Re: [Full-disclosure] Security issue in Filezilla 3.0.9.2: passwords are stored in plain text (sitemanager.xml)
- From: "Joey Mengele" <joey.mengele@xxxxxxxxxxxx>
- Date: Fri, 18 Apr 2008 15:21:48 -0400
I have noticed a similar, yet much more severe flaw in Filezilla.
When logging in to a remote server, Filezilla will send the
password in clear text without encrypting it. This means every
machine on the internet that it routes through can intercept it.
Same flaw, much more serious consequences, since, who has access to
your personal PC anyway?
J
On Fri, 18 Apr 2008 15:09:18 -0400 carl hardwick
<hardwick.carl@xxxxxxxxx> wrote:
A security issue in Filezilla 3.0.9.2 (and previous versions)
allows
local users to retrieve all saved passwords because they're stored
in
a plain text sitemanager.xml
<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<FileZilla3>
<Servers>
<Server>
<Host>ftpspace.domain.com</Host>
<Port>21</Port>
<Protocol>0</Protocol>
<Type>0</Type>
<Logontype>1</Logontype>
<User>user@xxxxxxxxxx</User>
<Pass>I'mAPlainTextPassword</Pass>
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
--
Love tea? Click and drink in fine teas from around the world.
http://tagline.hushmail.com/fc/Ioyw6h4dQrpDm7lVybi3tCFHWrTmyaROe9WzHSGYBdQQdStCmOcdVO/
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
- Follow-Ups:
- Prev by Date: [Full-disclosure] Security issue in Filezilla 3.0.9.2: passwords are stored in plain text (sitemanager.xml)
- Next by Date: Re: [Full-disclosure] Security issue in Filezilla 3.0.9.2: passwords are stored in plain text (sitemanager.xml)
- Previous by thread: Re: [Full-disclosure] Security issue in Filezilla 3.0.9.2: passwords are stored in plain text (sitemanager.xml)
- Next by thread: Re: [Full-disclosure] Security issue in Filezilla 3.0.9.2:passwords are stored in plain text (sitemanager.xml)
- Index(es):
Relevant Pages
|
