Thank you for being a valued part of the CNET community. As of December 1, 2020, the forums are in read-only format. In early 2021, CNET Forums will no longer be available. We are grateful for the participation and advice you have provided to one another over the years.

Thanks,

CNET Support

General discussion

Symantec FireWall/VPN Appliance model 200 leak of security

Feb 16, 2004 12:23AM PST

Feb 16 2004 7:49AM

Description of the Appliance:

The FireWall/VPN Appliance 200 is an integrated security and networking device that provides easy secure, and cost-effective Internet connectivity between locations. With its all-in-one functionality, small businesses and remote offices can create
a high-speed local network that enables secure access and interaction via the Internet with remote locations, business partners, and corporate networks.

The problem:

Editing the password administration page, the password is in clear text. To access the administration page, you have to insert the admin psw, but your password will be cached in your
pc and in every proxy server. It makes the Appliance NOT usefull to be managed remotely.

Solution:

Contacted the Symantec Enterprise Support, they told me the "feature" is "by design", because of the HTTP connection instead of HTTPS, so it was NOT a bug (even if they did not know about it).
My only statement was "adding vulns to vulns.. what about a java script?"

http://www.securityfocus.com/archive/1/353991/2004-02-13/2004-02-19/0

Discussion is locked