Nessus 42057: "Web Server Allows Password Auto-Completion"

[mrios]

Hello! We have scanned our Zimbra 5.0.18 install with Nessus and found the "Web Server Allows Password Auto-Completion" problem:

Tenable Network Security

Is this problem "fixable" by us, or will we need to enter a bug report and wait for updated code?

Thanks!
Mike Rios

[Rich Graves]

IMO a better answer to that threat includes locking screensavers and full-drive encryption for laptops. If you have those, then saved passwords aren't necessarily an exposure... except to a trojan specifically targeting the browser or OS password cache.

If dealing with that potential risk in that particular way is important to you, tell people "don't save passwords." This can be enforced with (something like) group policy.

Or, hack at the form, which is sommewhere around jetty/webapps/zimbra/public/login.jsp (zmmmailboxd stop; rm -rf jetty/work/*; zmmmailboxd start required to get rid of precompiled cache).

Or, don't use Zimbra's login form at all. Search for preauth.