Re: Apache ap_getpass vulnerability

[Pavel Kankovsky <peak () ARGO TROJA MFF CUNI CZ>]

On Sun, 2 Jan 2000, Simon Tamás wrote:

> Unless this is done somebody who gets access to the webserver machine,
> and therefore can read the private-key file, can also crash the Apache
> in such a way that he can read the password from memory. All he has to
> know is where the static char* inside getpass is in memory.

The same memory space where the decrypted private key is stored and ready
to be extracted the same way you would extract the password, right?

--Pavel Kankovsky aka Peak  [ Boycott Microsoft--http://www.vcnet.com/bms ]
"Resistance is futile. Open your source code and prepare for assimilation."