From: Secunia Security Advisories (sec-advsecunia.com)
Date: Tue Jun 03 2003 - 08:37:40 CDT

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

TITLE:
IRCXpro Server Username and Password Disclosure Vulnerability

READ ONLINE:
http://www.secunia.com/advisories/8934/

CRITICAL:
Less critical

IMPACT:
Exposure of sensitive information

WHERE:
Local system

SOFTWARE:
IRCXpro Server 1.x

DESCRIPTION:
A vulnerability has been identified in IRCXpro Server, which allows
malicious, local users to gain knowledge of usernames and passwords.

The problem is that usernames and passwords are stored in plain text
in the file "settings.ini", which can be read by any user.

SOLUTION:
Change permissions on "settings.ini" allowing only authorised users
to read the contents.

REPORTED BY / CREDITS:
morning_wood

ORIGINAL ADVISORY:
http://exploitlabs.com/files/advisories/EXPL-A-2003-002-ircxpro.txt

----------------------------------------------------------------------

Secunia recommends that you verify all advisories you receive, by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

Contact details:
Web : http://www.secunia.com/
E-mail : supportsecunia.com
Tel : +44 (0) 20 7016 2693
Fax : +44 (0) 20 7637 0419

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories

----------------------------------------------------------------------

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]