WinMySQLadmin 1.1 Store MySQL password in clear text

• Previous message: sco-securityat_private: "Security Update: [CSSA-2001-SCO.22] Open Unix, UnixWare 7: dtprintinfo environment buffer overflow"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Hi all,

WinMySQLadmin 1.1 store Mysql password in clear text in the file
c:\winnt\my.ini

---<my.ini>---
#This File was made using the WinMySQLadmin 1.1 Tool

[mysqld]
basedir=C:/mysql
datadir=C:/mysql/data

[WinMySQLadmin]
Server=C:/mysql/bin/mysqld-nt.exe
user=admin
password=XXXXX (in clear text)
QueryInterval=30
---<my.ini>---

It can be dangerous if someone can remotly read any file on your NT box with
typicall IIS hole such as
http://packetstormsecurity.org/9905-exploits/ms.iis4.showcode.txt or
anything else...

----
Cabezon Aurélien
http://www.iSecureLabs.com

• Next message: X-Force: "ISS Security Advisory: Multi-Vendor Format String Vulnerability in ToolTalk Service"
• Previous message: sco-securityat_private: "Security Update: [CSSA-2001-SCO.22] Open Unix, UnixWare 7: dtprintinfo environment buffer overflow"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Tue Oct 02 2001 - 08:26:56 PDT