Home page logo
/

fulldisclosure logo Full Disclosure mailing list archives

Re: [ GLSA 200601-15 ] Paros: Default administrator password
From: Yvan Boily <yboily () gmail com>
Date: Sun, 29 Jan 2006 21:14:53 -0600

Wasn't this reported a long time ago?

http://www.securityfocus.com/bid/15141
Paros is prone to a remote authentication bypass vulnerability.

This issue may result in the disclosure of sensitive information, and
possible execution of commands on the victim machine.

Paros version 3.2.5 is affected; earlier versions may also be vulnerable.

Update: version 3.2.6 was released and addresses this issue from
remote computers, as the database listens only on localhost by
default. This still allows local users to connect, as the default
username of "sa" with a blank password is still used.
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]