full-disclosure - Nate User Password Disclosed By Anonymous

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Fri Aug  5 03:54:37 2005
From: saintlinu at yahoo.co.kr (saintlinu)
Subject: Nate User Password Disclosed By Anonymous

Dear lists

 

----------------------[Cut Cut]---------------------------------------------

Title:             Nate User Password Disclosed By Anonymous

Discoverer:        PARK, GYU TAE (saintlinu@...l2root.org)

Advisory No.:      NRVA05-06

Critical:          High Critical

Impact:            User Information disclosed by unauthorized user

Where:             From remote

Operating System:  N / A

Solution:          Patched

Workaround:        N / A

 

Notice:            08. 01. 2005 Initiate notified

                   08. 04. 2005 Vendor responded and patched

                   08. 05. 2005 Disclosure vulnerability

 

Description: 

The Nate is portal service such as MSN, YAHOO on the Web in KOREA.

And interlocked NateOn Messenger (See a NRVA05-02)

 

When user requests URI on the NateWeb then shown up just like HTML document

but particular URI had included DEBUG CODE for Web-Programmer

 

Unfortunately DEBUG CODE is an USER'S INFORMATION like password

 

 

See following detail describe:

 

NOT INCLUDED HERE

----------------------[Cut Cut]---------------------------------------------

 

Cheers

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20050805/968b6f67/attachment.html