Qualys has identified a vulnerability

[Former Member]

I just received a report from the team here that my server running Crystal Reports Server XI R2 Windows has a vulnerability and I should contact the vendor for a fix. The vulnerability is below. Would any of the downloads address this?

TITLE:

Web Server Uses Plain-Text Form Based Authentication

THREAT:

The Web server uses plain-text form based authentication. A web page exists on the target host which uses an HTML login form. This data is sent from the client to the server in plain-text.

IMPACT:

An attacker with access to the network traffic to and from the target host may be able to obtain login credentials for other users by sniffing the network traffic.

SOLUTION:

Please contact the vendor of the hardware/software for a possible fix for the issue. For custom applications, ensure that data sent via HTML login forms is encrypted before being sent from the client to the host.

Thanks.

[denis_konovalov]

a. Crystal Reports Server XI R2 doesn't have web server, so what exactly does this report refers too ?

b. your software has been out of support for several years now, so vendor will not help you.

c. your software comes with tomcat as web application server or you might have deployed it on IIS, to fix this "vulnerability" you need to enable SSL/HTTPS on the one you're using. refer to tomcat or microsoft for instructions on how to enable SSL for their products.

[Former Member]

Hi,

Go to any service sicf and change the system logon procedure.

SICF->select any service i.e logon service->click on the service->error pages tab-> Login error tab->clock on configuration->select protocol login via https under action during logon section ->save

Thanks

Satish