bugtraq - Nate User Password Disclosed By Anonymous

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Fri, 5 Aug 2005 12:35:48 +0900
From: saintlinu@...l2root.org
To: bugtraq@...urityfocus.com
Subject: Nate User Password Disclosed By Anonymous


Title:             Nate User Password Disclosed By Anonymous
Discoverer:        PARK, GYU TAE (saintlinu@...l2root.org)
Advisory No.:      NRVA05-06
Critical:          High Critical
Impact:            User Information disclosed by unauthorized user
Where:             From remote
Operating System:  N / A
Solution:          Patched
Workaround:        N / A

Notice:            08. 01. 2005 Initiate notified
                   08. 04. 2005 Vendor responded and patched
                   08. 05. 2005 Disclosure vulnerability

Description: 
The Nate is portal service such as MSN, YAHOO on the Web in KOREA.
And interlocked NateOn Messenger(See a NRVA05-02)

When user requests URI on the NateWeb then shown up just like HTML document
but particular URI had included DEBUG CODE for Web-Programmer

Unfortunately DEBUG CODE is an USER'S INFORMATION like password


See following detail describe:

NOT INCLUDED HERE