RE: [cobalt-security] FW: Chili!Soft ASP Multiple Vulnerabilities FIX

["Audric Leperdi" <aleperdi@xxxxxxxxxxxxx>]

> ChiliSoft very politely returns the servers ADMIN and encrypted password
> to the browser.
You can always remove the samples virtual dirs in http.conf. (as the
security bulletin instructs)
Sorry I checked and there are no  references of the virtual dir in
http.conf. They are instead in /home/chiliasp/asp-server-3000/casp.cnfg and
they are called "applications".
It's simple: remove/comment_out those lines.


> The ChiliSoft Server Admin Password is the same as the Servers Main
> Admin aka Root.

Not true on my server (RaQ3i). Anyway you can change the casp admin password
by removing the user and recreating it immediately after using the shell
base admintool.

Audric