In some mail from IRCXpro Support, sie said: > > Vulnerability(s): > 1. Local clear passwords > > Our Reply: It is common place for all IRC Server applications to store clear > passwords in the IRCD.config files. The nature of the program is for it to > be used by Remote Users, NOT local ones.
There are a couple of extremely bad comments in these two sentences, let us dwell on it for a moment or two. Firstly, there has been support for storing passwords, encrypted, in configuration files on Unix for over 10 years, if not longer. I can go pull out some source code of that vintage with support for using crypt() to validate passwords if you're in doubt. Now, be that as it may, you've made a somewhat fatal assumption in your justification - that the remote users will never have any other access to the server that would let them browse the configuration at leisure. Windows, Linux, it does not matter, there are security threats to all environments that when exploited given outsiders some sort of "local access". I find it somewhat disturbing to see development of inferior security standards in products based on the supposition that nobody practises good security with the various IRC server passwords. Darren _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
