Bug 757666 - swaks: Passwords displayed in unfiltered / plaintext form when -a (authenticate) CLI option used
Summary: swaks: Passwords displayed in unfiltered / plaintext form when -a (authentica...
Keywords:
Status: CLOSED NOTABUG
Alias: None
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 757672 757673
Blocks:
TreeView+ depends on / blocked
 
Reported: 2011-11-28 10:40 UTC by Jan Lieskovsky
Modified: 2019-09-29 12:48 UTC (History)
2 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2011-11-28 11:19:23 UTC


Attachments (Terms of Use)

Description Jan Lieskovsky 2011-11-28 10:40:34 UTC
An information disclosure flaw was found in the way swaks, a command-line Swiss Army Knife SMTP transaction tester, performed management of passwords, provided on the command-line, when the -a (authenticate) option was used (the password has been displayed back in plaintext form to the relevant output file handle without being filtered first). A local attacker could use this flaw to potentially obtain plaintext form of passwords, the particular swaks SMTP user in question (victim) was using for different (swaks supported) authentication types.

References:
[1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=650024

Comment 1 Jan Lieskovsky 2011-11-28 10:59:18 UTC
This issue affects the versions of the swaks package, as shipped with Fedora EPEL 4, 5, and 6 releases. Please schedule an update once appropriate upstream patch / release available.

--

This issue affects the versions of the swaks package, as shipped with Fedora release of 14, 15, and 16. Please schedule an update once appropriate upstream patch / release available.

Comment 2 Jan Lieskovsky 2011-11-28 11:01:27 UTC
Created swaks tracking bugs for this issue

Affects: fedora-all [bug 757672]
Affects: epel-all [bug 757673]

Comment 3 Jan Lieskovsky 2011-11-28 11:19:23 UTC
Red Hat Security Response Team does not consider this deficiency to be a security flaw.

Comment 4 Jason Tibbitts 2011-11-28 17:50:29 UTC
Any chance someone could explain to me just what went on here?  Why would the security team open bugs only to close them afterwards?

It's never been any secret that swaks echoed back password input so I'm kind of puzzled as to why this is coming up now.


Note You need to log in before you can comment on or make changes to this bug.