Full Disclosure mailing list archives
Re: Google Talk cleartext credentials in process memory
From: Jaroslaw Sajko <sloik () parareal net>
Date: Tue, 29 Nov 2005 10:53:58 +0100
pagvac wrote:
Title: Google Talk Beta Messenger cleartext credentials in process memory Description Google Talk stores all user credentials (username and password) in clear-text in the process memory. Such vulnerability was found on August 25, 2005 (two days after the release of Google Talk) and has already been patched by Google. This issue would occur regardless of whether the "Save Password" feature was enabled or not.
The same issue concerns many applications, ie. Gadu-Gadu - another instant messenger. In my opinion such "vulnerabilities" are not worthy publishing (for Gadu-Gadu we have not published this kind of software behaviour) because if you can dump other user process or trick him to execute any code then reading the password from the process memory is only one of many things which you can do. regards, js _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Google Talk cleartext credentials in process memory pagvac (Nov 28)
- Re: Google Talk cleartext credentials in process memory Jaroslaw Sajko (Nov 29)
- Re: Google Talk cleartext credentials in process memory 6ackpace (Nov 29)
- Message not available
- Re: Google Talk cleartext credentials in process memory pagvac (Nov 29)
- Re: Google Talk cleartext credentials in process memory 6ackpace (Nov 29)
- Message not available
- Re: Google Talk cleartext credentials in process memory pagvac (Nov 29)
- Re: Google Talk cleartext credentials in process memory Stelian Ene (Nov 29)
- Re: Google Talk cleartext credentials in process memory Jaroslaw Sajko (Nov 29)
- Message not available
- Re: Google Talk cleartext credentials in process memory Jaroslaw Sajko (Nov 29)
- Re: Google Talk cleartext credentials in process memory Nasko Oskov (Nov 29)
- Re: Google Talk cleartext credentials in process memory Jaroslaw Sajko (Nov 29)
- Re: Google Talk cleartext credentials in process memory Georgi Guninski (Nov 29)
- Re: Google Talk cleartext credentials in process memory Kurt Grutzmacher (Nov 29)
- Re: Google Talk cleartext credentials in processmemory Brian Dessent (Nov 29)