full-disclosure - Re: IRCXpro 1.0 - Clear local and default remote admin passwords

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <200306031410.h53EADaA018335@caligula.anu.edu.au>
From: avalon at caligula.anu.edu.au (Darren Reed)
Subject: Re: IRCXpro 1.0 - Clear local and default remote admin passwords

In some mail from IRCXpro Support, sie said:
> 
> Vulnerability(s):
> 1. Local clear passwords
> 
> Our Reply: It is common place for all IRC Server applications to store clear
> passwords in the IRCD.config files.  The nature of the program is for it to
> be used by Remote Users, NOT local ones.

There are a couple of extremely bad comments in these two sentences,
let us dwell on it for a moment or two.

Firstly, there has been support for storing passwords, encrypted, in
configuration files on Unix for over 10 years, if not longer.  I can
go pull out some source code of that vintage with support for using
crypt() to validate passwords if you're in doubt.

Now, be that as it may, you've made a somewhat fatal assumption in
your justification - that the remote users will never have any other
access to the server that would let them  browse the configuration
at leisure.  Windows, Linux, it does not matter, there are security
threats to all environments that when exploited given outsiders some
sort of "local access".

I find it somewhat disturbing to see development of inferior security
standards in products based on the supposition that nobody practises
good security with the various IRC server passwords.

Darren