Re: Red Hat 6.2's ftp segmentation fault

[phr () DOC IC AC UK (Philip Rowlands)]

Paulo Ribeiro wrote:
>
[snip ftp crash]
> Any idea?

Try 'strings core'. You'll find your password nicely on display in
plaintext. This is hard to exploit, but still poor security. (Although
your password did just go across the network in plaintext, so a core
dump is the least of your problems).

The issue here is that your actual, cleartext password need *never*
appear on any disk, anywhere at any time. If it's being stored or
transmitted, it should be hashed or encrypted.

The authentication client (e.g. ftp, ssh) should mlock(2) the buffer
allocated for the password, and then memset(3) it as soon the
authetication is complete. Non-root processes can't ordinarily lock
memory, so you might find your password in swap. But there is no reason
to hang on to the password once authentication completes.

Phil