Evolvable Shambala Server 4.5 Plaintext Password Vulnerability

Bugtraq ID:	1771
Class:	Design Error
CVE:	CVE-2000-0954
Remote:	Yes
Local:	Yes
Published:	Oct 09 2000 12:00AM
Updated:	Jul 11 2009 03:56AM
Credit:	Posted to Bugtraq on October 9, 2000 by zillion <[email protected]>.
Vulnerable:	Evolvable Shambala Server 4.5 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows NT 4.0
Not Vulnerable:

Evolvable Shambala Server 4.5 Plaintext Password Vulnerability

Shambala Server is a FTP, Web, and Chat server targeted for the Small Office/Home Office user.

Shambala Server stores all of its passwords in plaintext in the following default location:

C:\Program Files\Shambala\passwords.txt

These passwords could be used to gain full control over Shambala Server and possibly other services if the passwords have been reused.

Evolvable Shambala Server 4.5 Plaintext Password Vulnerability

See discussion.

Evolvable Shambala Server 4.5 Plaintext Password Vulnerability

Solution:
Evolvable Corporation will be addressing this vulnerability in the upcoming release of Shambala Server.

Evolvable Shambala Server 4.5 Plaintext Password Vulnerability

References:

• Shambala Server Product Homepage (Evolvable Corporation)