mythfilldatabase shows first 6 letters of password with wget command

[Curtis Lee Bolin]

Binary package hint: mythtv

I saw hard drive activity on my server and ran iotop. I was astonished to see my username and the first 6 letters of my password to my schedulesdirect.org account in the wget command mythfilldatabase was executing. Other people use this server and they could easily see this.

wget --http-user=<username> --http-passwd=<first 6 letters of my password>~0-1.26437 --output-document=- --header=Accept-Encoding:gzip

Thank You For Your TIme

ProblemType: Bug
DistroRelease: Ubuntu 10.10
Package: mythtv-backend 0.23.1+fixes26437-0ubuntu1
ProcVersionSignature: Ubuntu 2.6.35-22.35-generic 2.6.35.4
Uname: Linux 2.6.35-22-generic x86_64
Architecture: amd64
Date: Tue Nov 9 00:07:33 2010
Installed_mythplugins-dbg: 0.0
Installed_mythtv-dbg: 0.0
MythTVDirectoryPermissions: lrwxrwxrwx 1 root root 21 2010-10-24 09:04 /var/lib/mythtv -> /media/storage/mythtv
ProcEnviron:
 LANG=en_US.UTF-8
 SHELL=/bin/bash
SourcePackage: mythtv

[Curtis Lee Bolin (curtisleebolin)]

I also noticed that wget was connecting to a non-ssl link

http://webservices.schedulesdirect.tmsdatadirect.com/schedulesdirect/tvlistings/xtvdService

so I imagine this info is also being transmitted insecurely over the internet.

Thank You For Your Time

[Kees Cook (kees)]

Thanks for the report! Have you communicated with the upstream MythTV author about this yet?

[MarcRandolph (mrand)]

Not sure how this ticket didn't get noticed. I forwarded it upstream.

[Karl Egly (dekarl)]

#9555 has been fixed upstream for the upcoming 0.25 release

[Mario Limonciello (superm1)]

0.25 in precise. -> fix released.