[Full-disclosure] Security issue in Filezilla 126.96.36.199:passwordsare stored in plain text (sitemanager.xml)
andfarm at gmail.com
Mon Apr 21 22:21:21 BST 2008
On 21 Apr 08, at 12:43, Valdis.Kletnieks at vt.edu wrote:
> On Mon, 21 Apr 2008 15:04:19 EDT, Joey Mengele said:
>> Exactly, I was talking about the RFC that supersedes that
>> particular RFC.
> 0959 File Transfer Protocol. J. Postel, J. Reynolds. October 1985.
> (Format: TXT=147316 bytes) (Obsoletes RFC0765) (Updated by
> RFC2640, RFC2773, RFC3659) (Also STD0009) (Status: STANDARD)
There is a 3.4.3 in RFC 959 which discusses a "COMPRESSED MODE", which
might look superficially like encryption to the untrained eye.
However, it appears that most modern FTP clients (and many FTP
servers, in fact) don't support it. Also, it's not encrypted.
Full-Disclosure is hosted and sponsored by Secunia.