Web Server 4D May Disclose Passwords to Local Users
|
|
SecurityTracker Alert ID: 1005286 |
|
CVE Reference: GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Sep 25 2002
|
Impact: Disclosure of authentication information
|
Exploit Included: Yes
|
Advisory: SecurityOffice.net
|
Version(s): 3.6
|
Description: A password disclosure vulnerability was reported in MDG's Web Server 4D. A local user can view passwords.
SecurityOffice.net reported that usernames and passwords are stored in clear text in the "Ws4d.4DD" file. On Windows-based systems, this may be located in C:\Program Files\MDG\Web Server 4D 3.6.0\Ws4d.4DD.
|
Impact: A local user can view passwords for the web server and related commerce applications.
|
Solution: No solution was available at the time of this entry.
|
Vendor URL: www.mdg.com/products/index.html (Links to External Site)
|
Cause: Access control error
|
Underlying OS: MacOS, Windows (NT), Windows (2000), Windows (XP)
|
Underlying OS Comments: Tested on Windows 2000
|
Reported By: Tamer Sahin <ts@securityoffice.net>
|
Message History:
None.
|
Source Message Contents
|
|
|
[Original Message Not Available for Viewing]
|
|
