Possible vulnerability when winSCP crashes on WinXP
Hello all,
I checked through the forums and couldn't find a reference to this so here goes... I was running version 2.1 on windowsXP. After logging in and during a transfer the program crashed and Windows "helpfully" asked if I wished to send a report of that to Microsoft. Included in the report was a memory dump. Curious, I ran strings against it and the password of my session was included in the dump along with the ip adress and username, which is sent unencrypted to Microsoft. Is this normal activity? Does the password still need to loaded in memory while the proggy is in use? Has this problem occured before?
I checked through the forums and couldn't find a reference to this so here goes... I was running version 2.1 on windowsXP. After logging in and during a transfer the program crashed and Windows "helpfully" asked if I wished to send a report of that to Microsoft. Included in the report was a memory dump. Curious, I ran strings against it and the password of my session was included in the dump along with the ip adress and username, which is sent unencrypted to Microsoft. Is this normal activity? Does the password still need to loaded in memory while the proggy is in use? Has this problem occured before?
