Full Disclosure mailing list archives
Re: Putty Proxy login/password discolsure....
From: Paul Schmehl <pauls () utdallas edu>
Date: Wed, 25 Oct 2006 12:34:49 -0500
--On Wednesday, October 25, 2006 10:24:11 -0400 mflaschen3 () mail gatech edu wrote:
Unix offers no security against local users either. If I can sit at the console, I can login in single user mode, mount the drives rw and edit /etc/passwd all day.Windows offers no security against local users. It is trivial to boot to a program like ERD Commander and replace admin passwords. On the other hand, PuTTy is meant to protect against everyone; that's why it doesn't allow saved passwords. Thus, this seems like a vulnerability to me.
Furthermore, I can take any hard drive, with any file system on it, and with the right tools I can read everything on the drive, even deleted stuff.
So what's your point? That when you own the box you own the box?If you first have to own the box to get to the information, then it's not a vulnerability. It's not best practice, but it's not a vulnerability.
Paul Schmehl (pauls () utdallas edu) Senior Information Security Analyst The University of Texas at Dallas http://www.utdallas.edu/ir/security/
Attachment:
_bin
Description:
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Putty Proxy login/password discolsure.... Antoine SANTO (Oct 25)
- RE : Putty Proxy login/password discolsure.... Antoine SANTO (Oct 25)
- Re: RE : Putty Proxy login/password discolsure.... Heiko Zuerker (Oct 25)
- Re: Putty Proxy login/password discolsure.... Dave "No, not that one" Korn (Oct 25)
- RE : Putty Proxy login/password discolsure....(Answer from PUTTY Staff) Antoine SANTO (Oct 25)
- Re: RE : Putty Proxy login/password discolsure....(Answer from PUTTY Staff) Matthew Flaschen (Oct 25)
- Re: RE : Putty Proxy login/password discolsure....(Answer from PUTTY Staff) Simon Tatham (Oct 25)
- Re: RE : Putty Proxy login/password discolsure....(Answer from PUTTY Staff) Matthew Flaschen (Oct 25)
- Re: RE : Putty Proxy login/password discolsure....(Answer from PUTTY Staff) Simon Tatham (Oct 25)
- RE : Putty Proxy login/password discolsure....(Answer from PUTTY Staff) Antoine SANTO (Oct 25)
- RE : Putty Proxy login/password discolsure.... Antoine SANTO (Oct 25)
- Re: Putty Proxy login/password discolsure.... Paul Schmehl (Oct 25)
- Re: Putty Proxy login/password discolsure.... cardoso (Oct 25)
- Re: Putty Proxy login/password discolsure.... Raj Mathur (Oct 25)
- Re: Putty Proxy login/password discolsure.... cardoso (Oct 25)
- Re: Putty Proxy login/password discolsure.... Paul Schmehl (Oct 25)
- Re: Putty Proxy login/password discolsure.... Robert Jaroszuk (Oct 26)
- Re: Putty Proxy login/password discolsure.... Juan Pablo Daniel Borgna (Oct 29)