[SA23339] Ozeki HTTP-SMS Gateway Password Disclosure Security Issue

Les derniers commentaires publiés sur SecuObs (1-5):

- ESRT @ITVulnerability - PeerSec MatrixSSL - Embedded SSL and TLS implementati - ESRT @packet_storm - Nux Keylogger 0.0.1 - ESRT @threatpost - New capabilities are strengthening the ZeuS botnet allowin - Wireshark Display Filters cheatsheet v2.0 - tcpdump cheatsheet v2.0 Les derniers commentaires publiés sur SecuObs (6-25) Tous les commentaires publiés sur SecuObs avant les 5 derniers

[Message Precedent sur la mailing][Message Suivant sur la mailing][Precedent dans le fil][Prochain dans le fil][Index par Date][Index par fil] [SA23339] Ozeki HTTP-SMS Gateway Password Disclosure Security Issue

Secunia is proud to announce the availability of the Secunia Software Inspector.

The Secunia Software Inspector is a free service that detects insecure versions of software that you may have installed in your system. When insecure versions are detected, the Secunia Software Inspector also provides thorough guidelines for updating the software to the latest secure version from the vendor.

Try it out online: link://[click]

TITLE: Ozeki HTTP-SMS Gateway Password Disclosure Security Issue

SECUNIA ADVISORY ID: SA23339

VERIFY ADVISORY: link://[click]

CRITICAL: Less critical

IMPACT: Exposure of sensitive information

WHERE: Local system SOFTWARE: Ozeki HTTP-SMS Gateway 1.x link://[click]

DESCRIPTION: basher13 has discovered a security issue in Ozeki HTTP-SMS Gateway, which can be exploited by malicious, local users to gain knowledge of sensitive information.

The problem is that usernames and passwords are stored in cleartext in the registry under "HKEY_LOCAL_MACHINE\Software\Ozeki\SMSServer\CurrentVersion\Plugins\httpsmsgate", which is readable by all user accounts on the system.

The security issue is confirmed in version 1.0. Other versions may also be affected.

SOLUTION: Set the proper permissions on the "Ozeki" registry key.

PROVIDED AND/OR DISCOVERED BY: basher13

About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities.

Subscribe: link://[click]

Definitions: (Criticality, Where etc.) link://[click]

Please Note: Secunia recommends that you verify all advisories you receive by clicking the link.

Secunia NEVER sends attached files with advisories.

Secunia does not advise people to install third party patches, only use those supplied by the vendor.

Precedent par Date: [SA23398] Sun Java JRE Applet Security Bypass
Suivant par Date: [SA23426] CA Portal Technology Session Handling Vulnerability
Precedent par fil : [SA23398] Sun Java JRE Applet Security Bypass
Suivant par fil : [SA23426] CA Portal Technology Session Handling Vulnerability
Index(s):
- Date
- Fil

Archives de la liste de diffusion Secunia
Archives de la liste de diffusion BugTraq
Archives de la liste de diffusion DailyDave
Archives de la liste de diffusion FunSec
Archives de la liste de diffusion Full Disclosure
Archives de la liste de diffusion Focus-IDS (FD)
Archives de la liste de diffusion Webappsec (FD)
Archives de la liste de diffusion Security-basics (FD)
Archives de la liste de diffusion Vulndiscuss
Archives de la liste de diffusion Vulnwatch

Les derniers commentaires publiés sur SecuObs (6-25):

- ESRT @virturity - Virtualization security assessment modules for Metasploit V - ESRT @opexxx - Meterpreter script for extracting information from Windows lnk - Update on Microsoft Security Advisory 981374 - SSD Tools Crack Passwords 100 Times Faster - phpMyAdmin version 3.3.0 suffers from a cross site scripting vulnerability - libcap-ng 0.6.3 - iScanner v0.4 released - Malicious codes scanner - A vulnerability in Apple Safari, caused by an integer overflow error in Color - CHScanner is an ARP, IPv4 and IPv6 network scanner with 31 scan methods - Burp Suite Tutorial The Intruder Tool - Skype - URI Handler Input Validation - OWASP CSRFTester Test Applications for CSRF - ESRT @MarioVilas @DidierStevens - Added shellcode to Tweet to my library - ESRT @ThisIsHNN @th3j35t3r - releases 2nd video of enhanced XerXeS attack - i - plecost v0.2.2-7 Beta Update - cookiemonster v1.6 - Automatic Reverse Engineering of Data Structures from Binary Execution - Samhain v2.6.3 Beltane v2.3.19 released - Social-Engineering Ninja v0.1 Beta - PHP scripts - Botan 1.9.4 Les cinq derniers commentaires publiés sur SecuObs Tous les commentaires publiés sur SecuObs avant les 25 derniers

SecuToolBox :

Bluetooth Stack Smasher v0.6 / Bluetooth Stack Smasher v0.8 / Slides Bluetooth Eurosec 2006 / Exposé vidéo Windows Shellcode - Kostya Kortchinsky / Exposé audio Reverse Engineering - Nicolas Brulez / Exposé vidéo Securitech - Pierre Betouin / WEP aircrack + Ubiquiti (MadWifi) 300 mW + Yagi / Secure WIFI WPA + EAP-TLS + Freeradius / Audit Windows / Captive Password Windows / USBDumper / USBDumper 2 / Hacking Hardware / WishMaster backdoor / DNS Auditing Tool / Ettercap SSL MITM / Exploit vulnérabilités Windows / Memory Dumper Kernel Hardening / Reverse Engineering / Scapy / SecUbuLIVE CD / Metasploit / eEye Blink Sec Center / eEye Retina Scanner + d'outils / + de tutoriels

Mini-Tagwall des articles publiés sur SecuObs :

sécurité, exploit, windows, microsoft, réseau, attaque, outil, vulnérabilité, audit, système, virus, internet, données, présentation, linux, metasploit, bluetooth, protocol, vista, réseaux, shell, scanner, engineering, rootkit, wishmaster, trames, conférence, source, paquet, téléphone, mobile, sysun, noyau, rapport, botnet, téléphones, mémoire, https, navigateur, intel, patch, reverse, libre, scapy, securitech + de mots clés avec l'annuaire des articles publiés sur SecuObs

Archives Failles Secunia :

- SA38905 Debian update for linux-2.6 - SA38927 Fedora update for cups - SA38932 Apple Safari Multiple Vulnerabilities - SA38900 Eros Webkatalog id SQL Injection Vulnerability - SA38888 Unbound Memory Alignment Denial of Service + d'archives failles avec Secunia et SecuMail

Archives Mailing Full Disclosure :

- Full-disclosure Claude Mercier/CLSC-CHSLD BVLV/Reg03/SSSS est absent(e). - Full-disclosure 2nd CfP: ACCESS 2010 \|\| September 20-25, 2010 - Valencia, Spain - Full-disclosure ...because you can't get enough of clickjacking - Re: Full-disclosure SecurityFocus to partially shut down - Re: Full-disclosure SecurityFocus to partially shut down + d'archives Full Disclosure avec SecuMail

Archives Mailing Bugtraq :

- VUPEN Security Research - Apple Safari ColorSync Profile Integer Overflow Vulnerability - XSS I found a xss in phpmyadmin 3.3.0 when we create new database in interface! - SECURITY DSA 2014-1 New moin packages fix several vulnerabilities - USN-911-1 MoinMoin vulnerabilities - iDefense Security Advisory 03.11.10: Multiple Vendor WebKit HTML Element Use After Free Vulnerability - SECURITY DSA 2013-1 New egroupware packages fix several vulnerabilities + d'archives Bugtraq avec SecuMail

Mini-Tagwall de l'annuaire video :

vmware, security, virus, biometric, windows, lockpicking, password, botnet, metasploit, tutorial, attack, crypt, linux, network, iphone, server, exploit, wimax, conficker, virtu, virtual, engineering, cisco, reverse, ettercap, wireshark, shmoocon, hacker, firewall, internet, knoppix, rootkit, arduino, conference, source, wireless, backtrack, openbsd, brucon, systm, overflow, openssh, buffer, access, remote + de mots clés avec l'annuaire des videos

Mini-Tagwall des articles de la revue de presse :

security, microsoft, windows, hacker, attack, network, vulnerability, google, exploit, malware, internet, remote, iphone, server, inject, patch, apple, twitter, mobile, virus, ebook, facebook, vulnérabilité, crypt, source, linux, password, intel, research, virtual, phish, access, tutorial, trojan, social, privacy, firefox, adobe, overflow, office, cisco, conficker, botnet, pirate, sécurité + de mots clés avec l'annuaire de la revue de presse

Mini-Tagwall des Tweets de la revue Twitter :

security, linux, botnet, attack, metasploit, cisco, defcon, phish, exploit, google, inject, server, firewall, network, twitter, vmware, windows, microsoft, compliance, vulnerability, python, engineering, source, kernel, crypt, social, overflow, nessus, crack, hacker, virus, iphone, patch, virtual, javascript, malware, conficker, pentest, research, email, password, adobe, apache, proxy, backtrack + de mots clés avec l'annuaire de la revue Twitter