bugtraq - Mercury Messenger

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <CC604210-7E09-4036-A2AF-3BED33D57E32@xs4all.nl>
Date: Sat, 15 Jul 2006 22:08:31 +0200
From: Hans Wolters <hans.wolters@...all.nl>
To: bugtraq@...urityfocus.com
Subject: Mercury Messenger

Problem description:

Mercury Messenger, http://www.mercury.to/,  is a java based messenger  
that will allow it's users to chat with MSN users. Currently it has  
been noted by two people that on a multi user OS X platform it is  
possible to read the chat logs from other users. The user specific  
directory in the /Users dir holds a Mercury specific directory with  
settings and chat logs. These directories and files are world readable.

The owner of the software has been contacted on Juli the 11th. We  
discussed the problem shortly but I did not receive any answer after  
that date. I tried to contact them again later this week but there  
has been no response.

For a quick fix sysadmins could make sure the specified directories  
are not world readable.

Kind regards,

Hans Wolters