RE: FTP "Network Place" with saved password will reveal cached pa ssword

From: jones, gerald (jones_geraldat_private)
Date: Fri Dec 14 2001 - 13:10:57 PST

Next message: dfeldman: "Trust issues with RH and Debian package managers"

Previous message: G.Borglum: "HP-UX setuid rlpdaemon induced to make illicit file writes"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

I just tried this using a Windows 2000 Professional as a client and a
Windows 2000 Server running IIS 5.0. TFor an FTP Network Place, the password
was displayed in the address bar after adding the first "../", whether the
password was saved or not. The ftp (IE) window changed to "This page cannot
be displayed", as expected (not allowed to go above ftp root).

Gerry Jones


-----Original Message-----
From: Aaron Heck [mailto:AHeckat_private]
Sent: Friday, December 14, 2001 1:46 PM
To: bugtraqat_private
Subject: FTP "Network Place" with saved password will reveal cached
password


Summary:
When a "Network Place" has been added to "My Network Places" with a
saved username and password it is possible to get Explorer to display
the password in cleartext format by altering the path in the address
bar.

<snip>
 
Aaron Heck
Instructional Microcomputer Resource Coordinator
Okanagan University College
aheckat_private

Next message: dfeldman: "Trust issues with RH and Debian package managers"
Previous message: G.Borglum: "HP-UX setuid rlpdaemon induced to make illicit file writes"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Sun Dec 16 2001 - 20:06:13 PST