full-disclosure - TheServer cleartext password sillyness.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

From: lwc at vapid.ath.cx (Larry W. Cashdollar)
Subject: TheServer cleartext password sillyness.

				Vapid Labs
			       Security Note

A quick note on Fastlink Software's TheServer http server.  I was not
going to write this up since it is a silly problem but this server is
listed in the netcraft survey so people are using it.  TheServer is a very
small and simple webserver for the Windows platform it consists of a
single executable and configuration file.

Problem: TheServer stores the password for log file accesss in cleartext.
This password is stored in the server.ini file.  Which by default resides
in the servers root directory.  This is a VERY simple webserver for
Windows 98/95 if the server is setup to log, then the password is also
sent to the logfile when accessing the server logs remotely.  The risk is
you can have someone else parsing your weblogs that you never intended.

Vendor:
http://www.fastlinksoftware.com/

Netcraft Survey:
http://www.netcraft.com/Survey/servers.html

Larry Cashdollar
Vapid Labs
http://vapid.ath.cx