Secunia

Eric Beaulieu has reported a security issue in Websense, which can be exploited by malicious, local users to disclose sensitive information.

The security issue is caused due to the Websense Reporter Module storing the password for the administrative SQL user in plain text in the file "CreateDbInstall.log" within a accessible zip file in the installation directory.

The security issue is reported in the Websense Reporter Module in Websense version 6.3.2. Other versions may also be affected.

Solution
Grant only trusted users access to affected systems.
Further details available in Customer Area

Provided and/or discovered by
Eric Beaulieu

Changelog
Further details available in Customer Area

Original Advisory
Websense:
http://kb.websense.com/article.asp?article=3734&p=12

Eric Beaulieu:
http://zebux.free.fr/pub/Advisory/Advisory_Websense_Reporter_Password_Disclosure_200810.txt

Deep Links
Links available in Customer Area