Hotfoon Dialer Plain Text Password Storage Vulnerability

Bugtraq ID:	6155
Class:	Design Error
CVE:
Remote:	No
Local:	Yes
Published:	Nov 11 2002 12:00AM
Updated:	Nov 11 2002 12:00AM
Credit:	Discovery of this vulnerability credited to S G Masood <[email protected]>.
Vulnerable:	Hotfoon Hotfoon 4.0
Not Vulnerable:

Hotfoon Dialer Plain Text Password Storage Vulnerability

A problem with Hotfoon4.exe has been discovered that may allow an attacker to gain access to authentication credentials.

It has been reported that Hotfoon4.exe does not safely store the user's password. Hotfoon4.exe stores the user's password in plain text in a registry

Hotfoon Dialer Plain Text Password Storage Vulnerability

There is no exploit required.

Hotfoon Dialer Plain Text Password Storage Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Hotfoon Dialer Plain Text Password Storage Vulnerability

References:

• Hotfoon (Hotfoon)
  
• Multiple Vuln. in Hotfoon.com's Hotfoon4.exe dialer (S G Masood )