bugtraq - CamFrog Password Disclosure Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Fri, 6 Feb 2009 13:23:44 -0700
From: zigmatn@...il.com
To: bugtraq@...urityfocus.com
Subject: CamFrog Password Disclosure Vulnerability

Advisory:

CamFrog Video Chat Password Disclosure Vulnerability.

Versions Affected:

CamFrog Video Chat Version 5.0(Free one)
Camfrog Pro 5.2 (paied one $49.95)

Release Date:

7 February 2009

Description:

CamFrog Video Chat 5.0 and Camfrog Pro 5.2 suffers from a Local password disclosure vulnerability due to the leak of proper encryption of credentials in the process level .In fact,the credentials can be extracted in clear text by dumping process memory of the live camfrog process when a connection is established.

Note : This vulnerability can be exploited by Social Engineering tricks such as fooling the user to execute malicious code wich would dump the memory of the process.

Proof of Concept:

http://nullarea.net/sploits/c/camfrog/poc.pdf

Credits:

Zigma [zigmatn{a.t}gmail.com]
http://NullArea.NET

Time Line Notification:

28-01-209 -- Contacted Via Email , Though no response till now