full-disclosure - Re: Security issue in Filezilla 3.0.9.2:passwords are stored in plain text (sitemanager.xml)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20080418202630.AD9DE118041@mailserver5.hushmail.com>
Date: Fri, 18 Apr 2008 16:26:30 -0400
From: "Joey Mengele" <joey.mengele@...hmail.com>
To: joey.mengele@...hmail.com, valdis.kletnieks@...edu
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: Security issue in Filezilla 3.0.9.2:passwords
	are stored in plain text (sitemanager.xml)

Valdis,

On Fri, 18 Apr 2008 16:24:13 -0400 Valdis.Kletnieks@...edu wrote:

>      3.4.3.  COMPRESSED MODE
>
>         There are three kinds of information to be sent:  regular 
>data,
>         sent in a byte string; compressed data, consisting of
>         replications or filler; and control information, sent in 
>a
>         two-byte escape sequence.  If n>0 bytes (up to 127) of 
>regular
>         data are sent, these n bytes are preceded by a byte with 
>the
>         left-most bit set to 0 and the right-most 7 bits 
>containing the
>         number n.
>
>If you think run-length-encoding compression is security, you're 
>even less
>clued than I thought.

My mistake, I meant 4.3.3.

J

--
Click here for the latest quotes on bankruptcy refinancing!
http://tagline.hushmail.com/fc/Ioyw6h4fRnroSLsvHrCYtJ9JDLtdNw4IP7N4gbgWgeI5CYmB23TeUw/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/