Are your User accounts setup with specific passwords or are you utilizing LDAP authentication?
Thanks Peter Lammey ESPN IT Client Architecture and Automation 860-766-4761 ________________________________ From: Action Request System discussion list(ARSList) [mailto:[email protected]] On Behalf Of Ian Trimnell Sent: Wednesday, May 20, 2009 8:13 AM To: [email protected] Subject: Security issue with 7.5 ** Greetings ARSlist. We have come across a fairly large security issue with AR System 7.5. If you use any of the new-style Templates which include in them graphics and then attempt to display these on the Windows Client (WUT) with active link logging turned on the Username and Password of the user will be displayed in clear text in the log file. The following is an edited version of the issue that I have open with our BMC Partner (Fusion): I have created a dummy account on our 7.5 patch 001 system and have logged in with that account using the 7.5 patch 001 WUT. I then turned on Active Link logging. Next I opened the uidemo form that BMC have provided as that has a number of templates with graphics in them. I clicked on the "Hover and Tooltips" panel and hovered the mouse over a row in the "Hover on Table Row" table. The window that resulted had the template text but no graphic was displayed (possibly understandable with the WUT). I then turned logging off. Search through the log file for any references to the field "Format Buffer" and you will see the full URL of any graphics file being shown along with the FULL log-in credentials of the dummy user. Here is any extract from the log file: <ACTL> Checking uidemo: Hover and Tooltips - on row select (0) <ACTL> -> Passed qualification -- perform if actions <ACTL> 0: Set Fields <ACTL> Format Buffer (536971496) = <html> <body leftmargin="0" topmargin="0"> <!--<div style="height:100%; background:#E6E6E6"> --> <table border="0"> <tr> <td><img src="http://newcicero.open.ac.uk:8888/arsys/sharedresources/image/ - srm_service_advanced.jpg?server=newcicero.open.ac.uk&username=dummy&pw - d=Youshouldntseethis&auth&native=1"<http://newcicero.open.ac.uk:8888/arsys/sharedresources/image/-srm_service_advanced.jpg?server=newcicero.open.ac.uk&username=dummy&pw-d=Youshouldntseethis&auth&native=1>/></td> <td colspan="2" style="padding:3px; vertical-align:top; font-weight:bold">Advanced</td> </tr> <tr> <td colspan="2"><font size="2">Advanced services including everything from A-Z</font></td> </tr> </table> <!-- </div> --> </body> </html> We are getting round this problem now by amending the workflow that calls the template so that a graphics-free template is used for WUT users. I am posting this here as I think that the wider AR System community need to know. If I get any feedback from BMC I will post it here, but going on another issue I currently have open with BMC I'm not holding my breath for an answer in the short term. Cheers, Ian ________________________________ Ian Trimnell, AR System Lead Developer (amongst other jobs), Specialist Support & Information Team, Academic & Administrative Computing Service Open University, MILTON KEYNES, UK Phone: 01908 653741 web: http://www.open.ac.uk/ The Open University is incorporated by Royal Charter (RC 000391), an exempt charity in England & Wales and a charity registered in Scotland (SC 038302). _Platinum Sponsor: [email protected] ARSlist: "Where the Answers Are"_ ________________________________ Please consider the environment before printing this e-mail. _______________________________________________________________________________ UNSUBSCRIBE or access ARSlist Archives at www.arslist.org Platinum Sponsor:[email protected] ARSlist: "Where the Answers Are"
