DB.DUMP contains passwords in PLAIN TEXT (ReadyNAS 314 OS6)

[hksscom]

I downloaded the logs via the ReadyNAS 314 > System > Logs > Download Logs button.

I looked over each logfile and discovered a DB.DUMP file. To my shock, I found that it contained the PLAIN TEXT password for backup jobs involving FTP or RSYNC. That is a serious problem. Can those passwords be encrypted and stored as such in the database?

Also, it appears that the DB.DUMP contains references to backup jobs that no longer exist. Where does ReadyNAS OS6 get the dump from, and how we can we dump the latest copy of the database?

Thanks!

[hksscom]

For those curious, I was provided the following info in a private message (name withheld unless that person wants it to be known):

"/var/readynasd/db.sq3

You can manage this using the sqlite3 command

db.dump is just a dump of this database"

Thank you to that person!

The only thing left now is the feedback to Netgear to have the passwords ENCRYPTED. That's important in today's day and age of hacks happening all the time.

[OOM-9]

Thank you for your feedback.

The changes are significant enough where we are expecting to have the fix in the 6.10.0 release.