bugtraq - YABB information leakage on failed login

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20040217100748.B31354@plough.barnyard.co.uk>
Date: Tue, 17 Feb 2004 10:07:48 +0000
From: David Cantrell <david@...trell.org.uk>
To: bugtraq@...urityfocus.com
Subject: YABB information leakage on failed login

YABB is a popular web-based bulletin board system, written in perl and
available from <http://www.yabbforum.com/>.  While evaluating it, I
found a minor issue where an attacker trying to log in to the forums can
extract some useful information making his job easier than it needs to
be.

Most YABB forums allow 'guest' users to browse postings, but some
require users to log in.  As this only applies in that latter case, the
impact of this vulnerability is low.

I have only looked at YABB version 1, SP 1.3.1.

In normal user login systems, such as the Unix login, any login failure
simply results in a message telling the user that he was unsuccessful,
but without saying whether the username was bogus or the password was
bogus.  When trying to log in to YABB with a bogus username the user is
told that the username is incorrect.  When trying to log in with a good
username but the wrong password, the user is told that the password is
incorrect.  This means that an attacker has to guess less information.

The YABB developers were informed of this on 2004-02-05 via sourceforge
and a patch submitted.  There has not yet been a response.

-- 
David Cantrell

    Planckton: n, the smallest possible living thing