lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Tue, 17 Feb 2004 10:07:48 +0000
From: David Cantrell <david@...trell.org.uk>
To: bugtraq@...urityfocus.com
Subject: YABB information leakage on failed login


YABB is a popular web-based bulletin board system, written in perl and
available from <http://www.yabbforum.com/>.  While evaluating it, I
found a minor issue where an attacker trying to log in to the forums can
extract some useful information making his job easier than it needs to
be.

Most YABB forums allow 'guest' users to browse postings, but some
require users to log in.  As this only applies in that latter case, the
impact of this vulnerability is low.

I have only looked at YABB version 1, SP 1.3.1.

In normal user login systems, such as the Unix login, any login failure
simply results in a message telling the user that he was unsuccessful,
but without saying whether the username was bogus or the password was
bogus.  When trying to log in to YABB with a bogus username the user is
told that the username is incorrect.  When trying to log in with a good
username but the wrong password, the user is told that the password is
incorrect.  This means that an attacker has to guess less information.

The YABB developers were informed of this on 2004-02-05 via sourceforge
and a patch submitted.  There has not yet been a response.

-- 
David Cantrell

    Planckton: n, the smallest possible living thing


Powered by blists - more mailing lists