bugtraq - Chetcpasswd 2.x: multiple vulnerabilities

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20061113190618.11097.qmail@securityfocus.com>
Date: 13 Nov 2006 19:06:18 -0000
From: riclem@...oo.com
To: bugtraq@...urityfocus.com
Subject: Chetcpasswd 2.x: multiple vulnerabilities

>From Debian.org:

"chetpasswd uses the HTTP_X_FORWARDED_FOR for authentication purposes(...). Obviously, HTTP_X_FORWARDED_FOR is not a trusted variable, and can be spoofed by any scriptkiddie who can read the man page of wget (...).

Furthermore, this cgi script doesn't seem to implement any rate limiting for the passwd checks, thereby  allowing for a dictionary attack via http.  Also, it seems to give different a error message if the user is not found then if the entered password is wrong, thereby exposing the names of user accounts to external attackers (...)."

The original message and others are available at http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=394454