bugtraq - re: Ariba Spend Management System

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20050901121241.17039.qmail@securityfocus.com>
Date: 1 Sep 2005 12:12:41 -0000
From: gerald626@...il.com
To: bugtraq@...urityfocus.com
Subject: re: Ariba Spend Management System

I would like to clarify some things.

First, I would like to apologize for any mis-representaiton due to a lack of proper explanation on my part.

My previous post was essentially true, that the username/password is being transmitted in clear text.  However, it is not in the URL as I previously claimed; after a closer look, it is in a post request.  Either way, the fact remains that it is still in the clear.

I tested this with the Ariba Buyer application.  The Ariba Spend Management System is a collection of applications.  However, my understanding is that most, if not all, of the applicaitons in the suite utilize the same authentication method.  Maybe somebody from Ariba can clarify this particular issue.

For those of you who requested a sample of my packet capture, I will be sending it shortly.

Gerald.