4289041 1999-09-08 17:34 /29 rader/ Postmaster Mottagare: Bugtraq (import) <7691> Ärende: gftp ------------------------------------------------------------ Approved-By: aleph1@SECURITYFOCUS.COM Delivered-To: bugtraq@securityfocus.com Content-Type: text/plain MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Message-ID: <99090511470400.01784@Cluestack.hb.se> Date: Sun, 5 Sep 1999 11:29:15 +0200 Reply-To: Oscar Haeger <viggen@ENTERPRISE.SHV.HB.SE> Sender: Bugtraq List <BUGTRAQ@SECURITYFOCUS.COM> From: Oscar Haeger <viggen@ENTERPRISE.SHV.HB.SE> X-To: bugtraq@securityfocus.com To: BUGTRAQ@SECURITYFOCUS.COM Hello. In gFTP1.13, an FTP-client that ships with RH6.0 the password is displayed in plain text in the log window and is also saved in plain text if you choose to save a logfile. Granted this is not a really big deal but if you save your download-files (and logfile) on a public area you would be giving away your password. I have spoken with the author and he has some new versions out which he recommends that you get and install. http://gftp.seol.org/ Latest version is 2.0.4 but this particular bug was fixed in 2.0.0. The reason why I send this to bugtraq is that this ftp-client is (one of) the default ftp-clients in RH6.0 and if you don't know about it then perhaps you won't go through the trouble of an upgrade. //Oscar (4289041) -----------------------------------