lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <1082075482.20040413160806@SECURITY.NNOV.RU>
From: 3APA3A at SECURITY.NNOV.RU (3APA3A)
Subject: Yahoo! Messenger 5.6 & Trillian (All Versions) - User Credential Disclosure Vulnerability

Dear Rafel Ivgi, The-Insider,

I see no "Medium" risk here. Under Windows 2000 and above TEMP points to
user's  profile and user's profile is secured with NTFS permissions, and
it's impossible for unprivileged user to read it. If you use FAT or user
has admin privileges there is a lot of ways to obtain password.

--Tuesday, April 13, 2004, 3:24:19 AM, you wrote to bugtraq@...urityfocus.com:

RITI> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

RITI> Application:    Yahoo! Messenger 5.6 & Trillian (All Versions)
RITI> Vendors:         http://messenger.yahoo.com/
RITI> Platforms:        Windows
RITI> Bug:                 User Credential Disclosure Vulnerability
RITI> Risk:                 Medium
RITI> Exploitation:    Local - (or remote by sniffing)
RITI> Date:                1 Apr 2004
RITI> Author:             Rafel Ivgi, The-Insider
RITI> e-mail:              the_insider@...l.com
RITI> web:                 http://theinsider.deep-ice.com

RITI> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

RITI> 1) Introduction
RITI> 2) Bugs
RITI> 3) The Code

RITI> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

RITI> ===============
RITI> 1) Introduction
RITI> ===============

RITI> Yahoo! Messenger one of the worlds most common, secure and easy to
RITI> use instant messangers.
RITI> You can stay connected to Yahoo! Messenger on your mobile phone
RITI> and message your mobile friends from your PC. More info Super Webcam
RITI> Enjoy high-quality, broadband video messaging with your friends! More info
RITI> New Emoticons Express yourself in whole new ways without writing a word!
RITI> See them all  IMVironments More IMVironments than ever before. (PC only)

RITI> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

RITI> ======
RITI> 2) Bug
RITI> ======

RITI> While using Yahoo Messanger a user recieves mail to his yahoo inbox.
RITI> Yahoo Messanger as well as Trillian pop-up a message box that allows
RITI> the user to check his mail box.

RITI> Upon clicking this message box a temporary html file is dumped to windows
RITI> temp folder. This html file contains the username and the PASSWORD of the
RITI> users yahoo account, in PLAIN TEXT format.

RITI> In addition to that it sets up the "Remmeber me" option which saves the
RITI> login cookie
RITI> which contains the login credentials - WITHOUT ASKING THE USER.

RITI> More over the connection opened uses standard HTTP protocol(which the
RITI> username
RITI> and password can be sniffed) instead of using the secure SSL login which is
RITI> supported
RITI> by yahoo.

RITI> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

RITI> ===========
RITI> 3) The Code
RITI> ===========

RITI> This is Proof Of Concept Code(the "temp" file which is generated):
RITI> ------------------- CUT HERE -------------------
RITI> <html>
RITI> <head>
RITI> <script>
RITI> <!--

RITI> var username;

RITI> username='<username>';

RITI> var password;

RITI> password='<password>';

RITI> function submit () {

RITI> document.getElementById('login').value=username;

RITI> document.getElementById('passwd').value=password;

RITI> document.getElementById('login_form').submit();

RITI> };

//-->>

RITI> </script>

RITI> </head>

RITI> <body onLoad='submit();'>

RITI> <form method=post action="https://login.yahoo.com/config/login" 
RITI> autocomplete=off name=login_form id=login_form onsubmit="return 
RITI> alert(document.forms['login_form'].login.value)">

RITI> <input type="hidden" name=".tries" value="1">
RITI> <input type="hidden" name=".src" value="ym">
RITI> <input type="hidden" name=".md5" value="">
RITI> <input type="hidden" name=".hash" value="">
RITI> <input type="hidden" name=".js" value="">
RITI> <input type="hidden" name=".last" value="2">
RITI> <input type="hidden" name="promo" value="">
RITI> <input type="hidden" name=".intl" value="us">
RITI> <input type="hidden" name=".bypass" value="">
RITI> <input type="hidden" name=".partner" value="">
RITI> <input type="hidden" name=".v" value="0">
RITI> <input type="hidden" name=".yplus" value="">
RITI> <input type="hidden" name=".emailCode" value="">
RITI> <input type="hidden" name="plg" value="">
RITI> <input type="hidden" name="stepid" value="">
RITI> <input type="hidden" name=".ev" value="">
RITI> <input type="hidden" name="hasMsgr" value="0">
RITI> <input type="hidden" name=".chkP" value="Y">
RITI> <input type="hidden" name=".done" value="http://mail.yahoo.com">
RITI> <input type="hidden" id="login" name="login" size="17" value="">

RITI> <input type="hidden" name="passwd" id="passwd" size="17" maxlength="32">

RITI> <input type="hidden" name=".save" value="Sign In">
RITI> </form></body>
RITI> </html>
RITI> ------------------- CUT HERE -------------------

RITI> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

RITI> --- 
RITI> Rafel Ivgi, The-Insider
RITI> http://theinsider.deep-ice.com

RITI> "Only the one who sees the invisible , Can do the Impossible." 

RITI> _______________________________________________
RITI> Full-Disclosure - We believe in it.
RITI> Charter: http://lists.netsys.com/full-disclosure-charter.html


-- 
~/ZARAZA
?????? ???. ? ???? ? ????? ??????? ?????? ?????-??????
?????, ??, ?? ?????????, ?????????? ? ??? ????. (????)


Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ