Jaroslaw, thanks for your post. You're right, the same issue occurs in *many* applications. However, any vendor that is serious about security should at least attempt to obfuscate the credentials in the process memory (IMHO).
I just published the advisory to let the public know that Google "fixed" this problem, that's all. However I respect your opinion and appreciate your post. On 11/29/05, Jaroslaw Sajko <[EMAIL PROTECTED]> wrote: > pagvac wrote: > > Title: Google Talk Beta Messenger cleartext credentials in process memory > > > > > > Description > > > > Google Talk stores all user credentials (username and password) in > > clear-text in the process memory. Such vulnerability was found on > > August 25, 2005 (two days after the release of Google Talk) and has > > already been patched by Google. > > > > This issue would occur regardless of whether the "Save Password" > > feature was enabled or not. > > The same issue concerns many applications, ie. Gadu-Gadu - another > instant messenger. In my opinion such "vulnerabilities" are not worthy > publishing (for Gadu-Gadu we have not published this kind of software > behaviour) because if you can dump other user process or trick him to > execute any code then reading the password from the process memory is > only one of many things which you can do. > > regards, > js > -- pagvac (Adrian Pastor) www.ikwt.com - In Knowledge We Trust -- pagvac (Adrian Pastor) www.ikwt.com - In Knowledge We Trust _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
