Full Disclosure mailing list archives
Re: Security issue in Filezilla 3.0.9.2: passwords are stored in plain text (sitemanager.xml)
From: "Joey Mengele" <joey.mengele () hushmail com>
Date: Fri, 18 Apr 2008 15:21:48 -0400
I have noticed a similar, yet much more severe flaw in Filezilla. When logging in to a remote server, Filezilla will send the password in clear text without encrypting it. This means every machine on the internet that it routes through can intercept it. Same flaw, much more serious consequences, since, who has access to your personal PC anyway? J On Fri, 18 Apr 2008 15:09:18 -0400 carl hardwick <hardwick.carl () gmail com> wrote:
A security issue in Filezilla 3.0.9.2 (and previous versions) allows local users to retrieve all saved passwords because they're stored in a plain text sitemanager.xml <?xml version="1.0" encoding="UTF-8" standalone="yes" ?> <FileZilla3> <Servers> <Server> <Host>ftpspace.domain.com</Host> <Port>21</Port> <Protocol>0</Protocol> <Type>0</Type> <Logontype>1</Logontype> <User>user () domain com</User> <Pass>I'mAPlainTextPassword</Pass> _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
-- Love tea? Click and drink in fine teas from around the world. http://tagline.hushmail.com/fc/Ioyw6h4dQrpDm7lVybi3tCFHWrTmyaROe9WzHSGYBdQQdStCmOcdVO/ _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Re: Security issue in Filezilla 3.0.9.2: passwords are stored in plain text (sitemanager.xml) Joey Mengele (Apr 18)
- Re: Security issue in Filezilla 3.0.9.2:passwords are stored in plain text (sitemanager.xml) Garrett M. Groff (Apr 18)