Re: Re: IRCXpro 1.0 - Clear local and default remote admin passwords

[Darren Reed <avalon () caligula anu edu au>]

In some mail from IRCXpro Support, sie said:
> Vulnerability(s):
> 1. Local clear passwords
>
> Our Reply: It is common place for all IRC Server applications to store clear
> passwords in the IRCD.config files.  The nature of the program is for it to
> be used by Remote Users, NOT local ones.

There are a couple of extremely bad comments in these two sentences,
let us dwell on it for a moment or two.

Firstly, there has been support for storing passwords, encrypted, in
configuration files on Unix for over 10 years, if not longer.  I can
go pull out some source code of that vintage with support for using
crypt() to validate passwords if you're in doubt.

Now, be that as it may, you've made a somewhat fatal assumption in
your justification - that the remote users will never have any other
access to the server that would let them  browse the configuration
at leisure.  Windows, Linux, it does not matter, there are security
threats to all environments that when exploited given outsiders some
sort of "local access".

I find it somewhat disturbing to see development of inferior security
standards in products based on the supposition that nobody practises
good security with the various IRC server passwords.

Darren
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html