Re: [Full-disclosure] Security issue in Filezilla 3.0.9.2:passwords are stored in plain text (sitemanager.xml)

That issue is inherent in the FTP protocol, not FileZilla.

Resolution: set up FTP server to use either SFTP or FTPS.

- G


----- Original Message -----
From: "Joey Mengele" <joey.mengele@xxxxxxxxxxxx>
To: <full-disclosure@xxxxxxxxxxxxxxxxx>; <hardwick.carl@xxxxxxxxx>
Sent: Friday, April 18, 2008 3:21 PM
Subject: Re: [Full-disclosure] Security issue in Filezilla 3.0.9.2:passwords
are stored in plain text (sitemanager.xml)


I have noticed a similar, yet much more severe flaw in Filezilla.
When logging in to a remote server, Filezilla will send the
password in clear text without encrypting it. This means every
machine on the internet that it routes through can intercept it.
Same flaw, much more serious consequences, since, who has access to
your personal PC anyway?

J

On Fri, 18 Apr 2008 15:09:18 -0400 carl hardwick
<hardwick.carl@xxxxxxxxx> wrote:
A security issue in Filezilla 3.0.9.2 (and previous versions)
allows
local users to retrieve all saved passwords because they're stored
in
a plain text sitemanager.xml

<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<FileZilla3>
<Servers>
<Server>
<Host>ftpspace.domain.com</Host>
<Port>21</Port>
<Protocol>0</Protocol>
<Type>0</Type>
<Logontype>1</Logontype>
<User>user@xxxxxxxxxx</User>
<Pass>I'mAPlainTextPassword</Pass>

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

--
Love tea? Click and drink in fine teas from around the world.
http://tagline.hushmail.com/fc/Ioyw6h4dQrpDm7lVybi3tCFHWrTmyaROe9WzHSGYBdQQdStCmOcdVO/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Relevant Pages

  • Re: [opensuse] ftp
    ... I have created a ftp account on my server that I use with filezilla ... Here is the difference in how filezilla behaves when I try and connect to my server: ... It seems my server doesn't like the command SYST. ...
    (SuSE)
  • Re: ftp client is not working to all sites since 5/5/08
    ... So how did you get a valid response with filezilla going to ... like i said it looks an ftp server application... ... So my issue is logging to my charter webpage. ...
    (microsoft.public.windowsxp.general)
  • Re: FTP root directories
    ... What I'm suggesting is that rather than using Microsoft's FTP, use Filezilla which is free. ... Windows Small Business Server 2008 Unleashed ... A Microsoft Registered Partner ...
    (microsoft.public.windows.server.sbs)
  • Re: [Full-disclosure] Security issue in Filezilla 3.0.9.2:passwords are stored in plain text (si
    ... "Supports FTP, FTP over SSL/TLS and SSH File Transfer Protocol ... Did you try selecting the option to use FTPS in FileZilla? ... Subject: [Full-disclosure] Security issue in Filezilla 3.0.9.2:passwords ... Hosted and sponsored by Secunia - http://secunia.com/ ...
    (Full-Disclosure)
  • Re: ftp set up
    ... I want the server as ... sentence as "ftp". ... then have Windows users use WinSCP. ... Portable FileZilla ...
    (freebsd-questions)