bugtraq - Re: KF Web Server 3.1.0 admin console XSS

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20070626132610.15567.qmail@securityfocus.com>
Date: 26 Jun 2007 13:26:10 -0000
From: support@...focus.net
To: bugtraq@...urityfocus.com
Subject: Re: KF Web Server 3.1.0 admin console XSS

Thank you Shay for finding this issue and taking the time to test our product.

We consider this issue to be of minor severity as it does not affect web sites hosted by the web server.

The problem is not in the web server itself but in the admin script hosted by the server. In order to access this script the attacker would need to be logged onto the server locally and have the admin password. With that level of access they would already have complete control of the web server configuration, in effect root access, so there would be no need to use this technique.

We do take this issue and all security issues seriously and have issued a patch which can be downloaded from our web site.

http://www.keyfocus.net/kfws/download/