Mediahouse Statistics Server contains cleartext administrator password
| mediahouse-stats-adminpw-cleartext (3287) |  Medium Risk |
Description:
Mediahouse Statistics Server (now known as LiveStats) provides weaker than expected security. Statistics Server stores the administrator password in cleartext in the ss.cfg configuration file. A user with local access to the ss.cfg file on the system could use the contained administrator password to gain control or make modifications to the Statistics Server.
Consequences:
Gain Access
Remedy:
Statistics Server is now known as LiveStats. Upgrade to the latest version of LiveStats (5.03 or later), available from the DeepMetrix (formerly Mediahouse) Web site. See References.
— AND —
Ensure that the directory in which the LiveStats ss.cfg file is located uses directory security settings that disallow unauthorized viewing of this file.
References:
- BugTraq Mailing List, Thu, 30 Sep 1999 21:21:45 -0000: Security flaw in Mediahouse Statistics Server v4.28 & 5.01.
- DeepMetrix Web site: LiveStats release notes.
- Per Bergehed's Web site: Security flaw in Mediahouse Statistics Server v4.28 & 5.01.
- BID-735: Mediahouse Statistics Server Cleartext Password Vulnerability
- CVE-1999-0932: Mediahouse Statistics Server allows remote attackers to read the administrator password, which is stored in cleartext in the ss.cfg file.
Platforms Affected:
- Mediahouse Software Mediahouse Statistics Server 4.28
- Mediahouse Software Mediahouse Statistics Server 5.0
Reported:
Sep 28, 1999
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net