bugtraq - Nate User Password Disclosed By Anonymous

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <28299.0687796429$1123254239@news.gmane.org>
Date: Fri, 5 Aug 2005 10:55:56 +0800
From: "saintlinu" <saintlinu@...oo.co.kr>
To: <bugtraq@...urityfocus.com>,
	<vulnwatch@...nwatch.org>,
	<full-disclosure@...ts.grok.org.uk>
Subject: Nate User Password Disclosed By Anonymous

Dear lists

 

----------------------[Cut Cut]---------------------------------------------

Title:             Nate User Password Disclosed By Anonymous

Discoverer:        PARK, GYU TAE (saintlinu@...l2root.org)

Advisory No.:      NRVA05-06

Critical:          High Critical

Impact:            User Information disclosed by unauthorized user

Where:             From remote

Operating System:  N / A

Solution:          Patched

Workaround:        N / A

 

Notice:            08. 01. 2005 Initiate notified

                   08. 04. 2005 Vendor responded and patched

                   08. 05. 2005 Disclosure vulnerability

 

Description: 

The Nate is portal service such as MSN, YAHOO on the Web in KOREA.

And interlocked NateOn Messenger (See a NRVA05-02)

 

When user requests URI on the NateWeb then shown up just like HTML document

but particular URI had included DEBUG CODE for Web-Programmer

 

Unfortunately DEBUG CODE is an USER'S INFORMATION like password

 

 

See following detail describe:

 

NOT INCLUDED HERE

----------------------[Cut Cut]---------------------------------------------

 

Cheers