Piranha password file

Looking at the default install of Piranha on RH 6.2 the password file is world readable and encrypted with standard DES. Hence any user with a shell account can download this password file and crack it in turn giving them access to the Piranha configuration and probably more. I'm still testing to see what else can be gained. I looked over the previous advisories on your site and Red Hat's and this wasn't mentioned.

_________________________________________________________________
Get your own free, private space on the Web at www.intranets.com.
Received on Jun 08 2000