lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Mon, 10 Dec 2012 16:46:46 GMT
Subject: Snare for Linux Password Disclosure

Snare for Linux Password Disclosure

Snare for Linux provides a 'C2' or 'CAPP' style audit 
subsystem for the Linux operating system. It can be
used as a standalone auditing tool for Linux, or can 
send data to the Snare Server for analysis and storage. 

Snare for Linux ships with a web interface that can be
used for viewing log data and configuring the agent.  In
the web interface at /remote, a user is able to set a password
for remote configuration of the agent.  The rendered page 
contains the field "RemotePassword" with its input type set
to password which masks the password in the interface, however
this is purely aesthetic.  By inspecting the page source and
examining the RemotePassword field, it is possible to retrieve
the MD5 hash of the current password.

All versions of Snare for Linux prior to 1.7.0 are vulnerable.

Users should upgrade to version 1.7.0 of Snare for Linux.

V. Credit
This vulnerability was discovered by Andrew Brooks.

VI. References

VII. Timeline
7/11/11 - Vendor notification
8/09/11 - Fixed and closed

Powered by blists - more mailing lists