From owner-freebsd-security Thu Oct 22 12:49:06 1998 Return-Path: Received: (from majordom@localhost) by hub.freebsd.org (8.8.8/8.8.8) id MAA17645 for freebsd-security-outgoing; Thu, 22 Oct 1998 12:49:06 -0700 (PDT) (envelope-from owner-freebsd-security@FreeBSD.ORG) Received: from gatekeeper.iserver.com (gatekeeper.iserver.com [206.107.170.2]) by hub.freebsd.org (8.8.8/8.8.8) with ESMTP id MAA17637 for ; Thu, 22 Oct 1998 12:49:02 -0700 (PDT) (envelope-from hart@iserver.com) Received: by gatekeeper.iserver.com; Thu, 22 Oct 1998 13:48:28 -0600 (MDT) Received: from unknown(192.168.1.109) by gatekeeper.iserver.com via smap (V3.1.1) id xma026701; Thu, 22 Oct 98 13:48:25 -0600 Received: (hart@localhost) by anchovy.orem.iserver.com (8.8.8) id NAA05447; Thu, 22 Oct 1998 13:48:53 -0600 (MDT) Date: Thu, 22 Oct 1998 13:48:52 -0600 (MDT) From: Paul Hart X-Sender: hart@anchovy.orem.iserver.com To: Deepwell Internet cc: freebsd-security@FreeBSD.ORG Subject: Re: FrontPage Server Extensions In-Reply-To: <4.1.0.67.19981022093228.009d4450@mail1.dcomm.net> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org On Thu, 22 Oct 1998, Deepwell Internet wrote: > People around the office have been saying that the FP extensions are > insecure and buggy, but no one can point to any real examples. Here's one for a start: http://users.worldgate.com/~marcs/fp/ Another possible attack that I have heard of is the lackadaisical attitude of the extensions with regards to the service.pwd files that contain password information, a la /etc/passwd, that can often be cracked by any of the popular DES/UNIX password cracking programs. Other anecdotes on FrontPage (in)security can be found by searching the BugTraq archives (search for "frontpage") at: http://www.netspace.org/lsv-archive/bugtraq.html Paul Hart -- Paul Robert Hart ><8> ><8> ><8> Verio Web Hosting, Inc. hart@iserver.com ><8> ><8> ><8> http://www.iserver.com/ To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message