CA's Archserve Exchange DB Agent saves passwords in the clear.
17 Nov. 1998
Summary
Cheyenne's (Now owned by Computer Associates) Archserve Exchange DB Agent v2 saves in the log file it creates, 'exchverify.log', under the root drive 'c:' a line which stores the NT Server name, NT Domain name, the administrator's Mailbox, the administrator's Login Name and the administrator's Password all in clear text.
While the Archserve Exchange DB Agent install itself, it stores a log file automatically in the root drive, making it possible for anyone with access to that drive (via the administrative shares or any other means) to gain knowledge of the administrator's username and password.
