[NT] Personal FTP Server Saves Passwords in the Clear
From: SecuriTeam (support_at_securiteam.com)
Date: 05/31/03
- Previous message: SecuriTeam: "[EXPL] Maelstrom Vulnerable to a Local Buffer Overflow (Another Exploit)"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
To: list@securiteam.com Date: 31 May 2003 11:22:10 +0200
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
In the US?
Contact Beyond Security at our new California office
housewarming rates on automated network vulnerability
scanning. We also welcome ISPs and other resellers!
Please contact us at: 323-882-8286 or ussales@beyondsecurity.com
- - - - - - - - -
Personal FTP Server Saves Passwords in the Clear
------------------------------------------------------------------------
SUMMARY
<http://home.t-online.de/home/m-roth> Personal FTP Server is "a easy to
use FTP server". However, the product has been found to store all the
usernames and passwords in an insecure way allowing a local attacker an
easy method of retrieving them.
DETAILS
Vulnerable systems:
* Personal FTP Server version 4.45
Personal FTP Server stores all usernames and passwords in the file
\Program Files\PFTP\PFTPUSERS3.USR in clear text. If a malicious user were
to gain access to this file, they would have a list of all usernames and
their associated passwords.
Vendor response:
The vendor has been notified on May 30, no response has been received so
far.
ADDITIONAL INFORMATION
The information has been provided by <mailto:vulncode@yahoo.com> Ziv
Kamir.
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.
- Previous message: SecuriTeam: "[EXPL] Maelstrom Vulnerable to a Local Buffer Overflow (Another Exploit)"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
