Full Disclosure mailing list archives
Re: Security issue in Filezilla 3.0.9.2:passwords are stored in plain text (sitemanager.xml)
From: "Garrett M. Groff" <groffg () gmgdesign com>
Date: Fri, 18 Apr 2008 16:04:29 -0400
Per the FileZilla feature page (http://filezilla-project.org/client_features.php): "Supports FTP, FTP over SSL/TLS (FTPS) and SSH File Transfer Protocol (SFTP)" Did you try selecting the option to use FTPS in FileZilla? Using the plain vanilla FTP protocol in any other FTP client will yield the same problem (plaintext passwords, commands, data, etc, over the communication channel). - G ----- Original Message ----- From: "Joey Mengele" <joey.mengele () hushmail com> To: <full-disclosure () lists grok org uk>; <groffg () gmgdesign com> Sent: Friday, April 18, 2008 3:42 PM Subject: Re: [Full-disclosure] Security issue in Filezilla 3.0.9.2:passwords are stored in plain text (sitemanager.xml)
I disagree, read the RFC. There are plenty of more secure FTP clients such as the OpenSSH.com groups proactive secure Secure FTP (sftp) implementation of FTP. J On Fri, 18 Apr 2008 15:36:34 -0400 "Garrett M. Groff" <groffg () gmgdesign com> wrote:That issue is inherent in the FTP protocol, not FileZilla. Resolution: set up FTP server to use either SFTP or FTPS. - G ----- Original Message ----- From: "Joey Mengele" <joey.mengele () hushmail com> To: <full-disclosure () lists grok org uk>; <hardwick.carl () gmail com> Sent: Friday, April 18, 2008 3:21 PM Subject: Re: [Full-disclosure] Security issue in Filezilla 3.0.9.2:passwords are stored in plain text (sitemanager.xml)I have noticed a similar, yet much more severe flaw in Filezilla. When logging in to a remote server, Filezilla will send the password in clear text without encrypting it. This means every machine on the internet that it routes through can intercept it. Same flaw, much more serious consequences, since, who has accesstoyour personal PC anyway? J On Fri, 18 Apr 2008 15:09:18 -0400 carl hardwick <hardwick.carl () gmail com> wrote:A security issue in Filezilla 3.0.9.2 (and previous versions) allows local users to retrieve all saved passwords because they'restoredin a plain text sitemanager.xml <?xml version="1.0" encoding="UTF-8" standalone="yes" ?> <FileZilla3> <Servers> <Server> <Host>ftpspace.domain.com</Host> <Port>21</Port> <Protocol>0</Protocol> <Type>0</Type> <Logontype>1</Logontype> <User>user () domain com</User> <Pass>I'mAPlainTextPassword</Pass> _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/-- Love tea? Click and drink in fine teas from around the world.http://tagline.hushmail.com/fc/Ioyw6h4dQrpDm7lVybi3tCFHWrTmyaROe9Wz HSGYBdQQdStCmOcdVO/_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/-- Click for free information on earning a medical transcriptionist degree. http://tagline.hushmail.com/fc/Ioyw6h4eKoYfamKuhgFCp2tVw5b2K1RUwTpG02BLOHutEXHEjHsDMT/
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Re: Security issue in Filezilla 3.0.9.2:passwords are stored in plain text (sitemanager.xml) Joey Mengele (Apr 18)
- Re: Security issue in Filezilla 3.0.9.2:passwords are stored in plain text (sitemanager.xml) Garrett M. Groff (Apr 18)
- Re: Security issue in Filezilla 3.0.9.2:passwords are stored in plain text (sitemanager.xml) Valdis . Kletnieks (Apr 18)
- <Possible follow-ups>
- Re: Security issue in Filezilla 3.0.9.2:passwords are stored in plain text (sitemanager.xml) Joey Mengele (Apr 18)
- Re: Security issue in Filezilla 3.0.9.2:passwords are stored in plain text (sitemanager.xml) Joey Mengele (Apr 18)
- Re: Security issue in Filezilla 3.0.9.2:passwords are stored in plain text (sitemanager.xml) Valdis . Kletnieks (Apr 18)
- Re: Security issue in Filezilla 3.0.9.2:passwords are stored in plain text (sitemanager.xml) Joey Mengele (Apr 18)
- Re: Security issue in Filezilla 3.0.9.2:passwordsare stored in plain text (sitemanager.xml) Garrett M. Groff (Apr 18)