<<< Date Index >>>     <<< Thread Index >>>

Hummingbird FTP Weak Password Encryption



Hummingbird FTP Weak Password Encryption


Critical: Less critical
Impact: Exposure of sensitive information
Where: Local system
Solution Status: Unpatched

Software: Hummingbird Connectivity 10.x
http://connectivity.hummingbird.com/products/nc/cpia.html


Description:
A vulnerability has been identified in Hummingbird FTP, which can be exploited 
by malicious, local users to gain knowledge of sensitive information.

The vulnerability is caused due to the use of a simple algorithm to "encrypt" 
passwords in FTP profiles (*.hfs). The problem is that a cipher text is 
generated by incrementing the plain text ASCII value of each password character 
by 125 (0x7d). This makes it trivial to gain knowledge of the password.

The vulnerability has been confirmed in version 10. However, prior versions may 
also be affected.


Solution:
Set proper ACLs for FTP profiles.

Found by:
nnposter

History:
Vendor notified July 13, 2005
Vendor acknowledged receipt July 13, 2005
Public release August 14, 2005