full-disclosure - [BMSA-2011-02] Cross site scripting in Yahoo! Pulse

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Wed, 18 May 2011 08:23:18 +0700
From: Nam Nguyen <namn@...emoon.com.vn>
To: full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com
Subject: [BMSA-2011-02] Cross site scripting in Yahoo!
	Pulse

BLUE MOON SECURITY ADVISORY 2011-02
===================================

:Title: Cross site scripting vulnerability in Yahoo! Pulse
:Severity: Critical
:Reporter: Thinh Q. Hoang and Blue Moon Consulting
:Products: Yahoo! Pulse
:Fixed in: latest version

Description
-----------

Yahoo! Pulse is a new Yahoo! product that allows you to keep in touch with your friends. We’ve made it easier to stay connected to the people who matter most and share what’s important!

Yahoo! Pulse suffers from a XSS vulnerability in its photo upload feature. If the file's name is ``junk" onmouseover=alert(document.cookie) "junk.jpg``, the page is injected with JavaScript.

Workaround
----------

There is no workaround.

Fix
---

A fix has been rolled out by Yahoo!.

Disclosure
----------

Blue Moon Consulting adapts `RFPolicy v2.0 <http://www.wiretrip.net/rfp/policy.html>`_ in notifying vendors.

:Initial vendor contact:

  May 10, 2011: Initial query sent to Yahoo! Security Team (YST).

:Vendor response:

  May 11, 2011: YST asked for steps to reproduce the bug.

:Further communication:

  May 11, 2011: Details sent to YST, encrypted.

  May 12, 2011: YST sent a reply, encrypted with their PUBLIC key!

  May 12, 2011: Request sent to YST to re-send the last message.

  May 13, 2011: YST re-sent the last message.

  May 16, 2011: YST informed us the bug was fixed.

  May 17, 2011: Confirmation sent to YST.

:Public disclosure: May 18, 2011

:Exploit code:

  No exploit code required.

Disclaimer
----------

The information provided in this advisory is provided "as is" without warranty of any kind. Blue Moon Consulting Co., Ltd disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. Your use of the information on the advisory or materials linked from the advisory is at your own risk. Blue Moon Consulting Co., Ltd reserves the right to change or update this notice at any time.

-- 
Nam Nguyen, CISA, CISSP, CSSLP
Blue Moon Consulting Co., Ltd
http://www.bluemoon.com.vn

Content of type "application/pgp-signature" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/