full-disclosure - [ GLSA 200601-15 ] Paros: Default administrator password

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Mon Jan 30 03:15:02 2006
From: yboily at gmail.com (Yvan Boily)
Subject: [ GLSA 200601-15 ] Paros: Default administrator
	password

Wasn't this reported a long time ago?

http://www.securityfocus.com/bid/15141
Paros is prone to a remote authentication bypass vulnerability.

This issue may result in the disclosure of sensitive information, and
possible execution of commands on the victim machine.

Paros version 3.2.5 is affected; earlier versions may also be vulnerable.

Update: version 3.2.6 was released and addresses this issue from
remote computers, as the database listens only on localhost by
default. This still allows local users to connect, as the default
username of "sa" with a blank password is still used.