[11762] in bugtraq
gftp
daemon@ATHENA.MIT.EDU (Oscar Haeger)
Thu Sep 9 00:51:16 1999
Content-Type: text/plain
Mime-Version: 1.0
Content-Transfer-Encoding: 8bit
Message-Id: <99090511470400.01784@Cluestack.hb.se>
Date: Sun, 5 Sep 1999 11:29:15 +0200
Reply-To: Oscar Haeger <viggen@ENTERPRISE.SHV.HB.SE>
From: Oscar Haeger <viggen@ENTERPRISE.SHV.HB.SE>
X-To: bugtraq@securityfocus.com
To: BUGTRAQ@SECURITYFOCUS.COM
Hello.
In gFTP1.13, an FTP-client that ships with RH6.0 the password is displayed in
plain text in the log window and is also saved in plain text if you choose to
save a logfile.
Granted this is not a really big deal but if you save your download-files (and
logfile) on a public area you would be giving away your password.
I have spoken with the author and he has some new versions out which he
recommends that you get and install.
http://gftp.seol.org/
Latest version is 2.0.4 but this particular bug was fixed in 2.0.0.
The reason why I send this to bugtraq is that this ftp-client is (one
of) the default ftp-clients in RH6.0 and if you don't know about it then perhaps
you won't go through the trouble of an upgrade.
//Oscar
