lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <20061026141452.30978.qmail@securityfocus.com>
Date: 26 Oct 2006 14:14:52 -0000
From: nnposter@...closed.not
To: bugtraq@...urityfocus.com
Subject: Insecure storage of passwords in Axalto Protiva

Insecure storage of passwords in Axalto Protiva


Critical: Less critical
Impact: Exposure of sensitive information
Where: Local system

Software: Axalto Protiva 1.1
http://www.protiva.axalto.com/
(Note: Vendor claims that it impacts only "non-commercial" versions or whatever that means in reality.)

Description: A vulnerability has been identified in Axalto Protiva, which can be exploited by malicious, local users to gain knowledge and manipulate sensitive information.

The vulnerability is caused due to storing application passwords as plaintext in files that are by default readable by all non-privileged users:

Keystore password in
(application directory)\KeyTool\keytool.config

Keystore password and Active Directory LDAP access credentials in
(Tomcat directory)\webapps\protiva\WEB-INF\classes\authserver.config


The vulnerability has been identified in version 1.1. However, other versions may be also affected.


Solution:
Set proper ACLs on the application directories. Restrict local login rights to privileged users.

Found by:
nnposter

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ