HLSW RCON Console Password Disclosure Weakness

Bugtraq ID:	8651
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Sep 18 2003 12:00AM
Updated:	Sep 18 2003 12:00AM
Credit:	The disclosure of this issue has been credited to Alexander 'xaitax' Hagenah <[email protected]> and Adrian 'p0beL' Waloschyk <[email protected]>.
Vulnerable:	HLSW HLSW 1.0 .0.8 beta HLSW HLSW 1.0 .0.7 beta HLSW HLSW 1.0 .0.6 beta HLSW HLSW 1.0 .0.5 beta HLSW HLSW 1.0 .0.4 beta
Not Vulnerable:

HLSW RCON Console Password Disclosure Weakness

It has been reported that RCON game server console is prone to a plaintext password disclosure weakness because user passwords are not ecrypted when exchanged between a client and a server. This issue may allow an attacker who is in a position to eavesdrop on client-server network traffic to harvest user authentication information.

Although unconfirmed HLSW versions 1.0.0.8 beta and prior could be prone to this issue.

HLSW RCON Console Password Disclosure Weakness

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

HLSW RCON Console Password Disclosure Weakness

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

HLSW RCON Console Password Disclosure Weakness

References:

• Home page (HLSW)
  
• Rcon Vulnerbility - Plaintext (Alexander Hagenah )