full-disclosure - Power Quest Deploy Center 5.5 boot disks

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <200408271049.i7RAnc626954@netsys.com>
From: opticfiber at topsight (opticfiber)
Subject: Power Quest Deploy Center 5.5 boot disks

A vulnerability has been found in power quest deploy center 5.5 boot disks.
Normally when creating a PQDI network boot disk, the administrator has the
option to have the machine login to a domain controller to access a shared
resource. Besides the authentication method using lm (insecure), a buffer
overflow exists in stuffit.com.

Stuffit.com is the control mechanism that allows the power quest boot disk
to decode/decrypt stored password(s) in stuffit.dat. A typical line in the
disks autoexec.bat file looks like: stuffit /f:stuffit.dat , this loads the
stored password resident in memory. However, if this same command is
repeated 4 or more times at the command prompt the program overflows,
actually printing the clear text password right on the command prompt.

William Reyor
Topsight.net

________________________________________________
This mail was sent by UebiMiau 2.5