Full Disclosure mailing list archives
TheServer cleartext password sillyness.
From: full-disclosure () lists netsys com (Larry W. Cashdollar)
Date: Wed, 17 Jul 2002 10:25:33 -0400 (EDT)
Vapid Labs Security Note A quick note on Fastlink Software's TheServer http server. I was not going to write this up since it is a silly problem but this server is listed in the netcraft survey so people are using it. TheServer is a very small and simple webserver for the Windows platform it consists of a single executable and configuration file. Problem: TheServer stores the password for log file accesss in cleartext. This password is stored in the server.ini file. Which by default resides in the servers root directory. This is a VERY simple webserver for Windows 98/95 if the server is setup to log, then the password is also sent to the logfile when accessing the server logs remotely. The risk is you can have someone else parsing your weblogs that you never intended. Vendor: http://www.fastlinksoftware.com/ Netcraft Survey: http://www.netcraft.com/Survey/servers.html Larry Cashdollar Vapid Labs http://vapid.ath.cx
Current thread:
- solaris 9 playpen Len Rose (Jul 16)
- solaris 9 playpen John Scimone (Jul 16)
- default list reply-to: address KF (Jul 16)
- default list reply-to: address Roland Postle (Jul 16)
- default list reply-to: address martin f krafft (Jul 17)
- default list reply-to: address hellNbak (Jul 17)
- default list reply-to: address KF (Jul 17)
- TheServer cleartext password sillyness. Larry W. Cashdollar (Jul 17)
- default list reply-to: address Roland Postle (Jul 16)
- default list reply-to: address Roland Postle (Jul 17)
- default list reply-to: address Ulf H{rnhammar (Jul 17)