full-disclosure - Contact to webmaster of messages.yahoo.com - bbs application sends broken HTTP header

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <857EA8B35CDEF59B7251B718@[10.3.62.6]>
Date: Fri Sep 30 16:04:30 2005
From: pbieringer at aerasec.de (Peter Bieringer)
Subject: Contact to webmaster of messages.yahoo.com - bbs
 application sends broken HTTP header

Hi,

it's not really security related, but it looks like it is impossible to 
find a contact address.

Reason for contact is that while using a more strict content filter engine 
(WebWasher) between client and server we found that "bbs" application on 
messages.yahoo.com send broken HTTP header:

Debug:
# ngrep -d <interface> 'GET|HTTP' host messages.yahoo.com

Request:
$ curl --compress -A "Mozilla/5.0" -D header.txt -o body.txt 
"http://messages.yahoo.com/bbs?action=q&board=TSG"

Client on address 84.153.90.***

All works fine:

HTTP/1.1 200 OK
Date: Fri, 30 Sep 2005 14:09:14 GMT
P3P: policyref="http://p3p.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM 
DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND 
PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV"
Cache-Control: private
Connection: close
Transfer-Encoding: chunked
Content-Type: text/html
Content-Encoding: gzip
Set-Cookie: B=5fjrc551jqhoa&b=3&s=7r; expires=Tue, 02-Jun-2037 20:00:00 
GMT; path=/; domain=.yahoo.com


Clients behind other addresses (located in Germany):

HTTP/1.1 200 OK
Date: Fri, 30 Sep 2005 14:05:25 GMT
P3P: policyref="http://p3p.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM 
DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND 
PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV"
P3P: policyref="http://p3p.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM 
DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND 
PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV"
Location: 
http://edit.my.yahoo.com/config/login?.src=mb&.done=messages.yahoo.com&lg=us&.intl=us
Cache-Control
<broken content, reproducable, always here>


Without requesting compression:

$ curl -A "Mozilla/5.0" -D header.txt -o body.txt 
"http://messages.yahoo.com/bbs?action=q&board=TSG"

HTTP/1.1 200 OK
Date: Fri, 30 Sep 2005 14:22:00 GMT
P3P: policyref="http://p3p.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR
 ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi 
IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV"
P3P: policyref="http://p3p.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM 
DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND 
PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV"
Location: http://edit.my.yahoo.com/config/login?.src=mb&.done=me36da
hoo.com&lg=us&.intl=us
Connection: close
Transfer-Encoding: chunked, chunked
Content-Type: text/html
Set-Cookie: B=4a94ep91jqig8&b=3&s=6n; expires=Tue, 02-Jun-2037 20:00:00 
GMT; path=/; domain=.yahoo.com

<html>....


Note here the improper header Transfer-Encoding value "chunked, chunked"
and broken Location-Header (CR/LF inbetween).

Perhaps nobody has detected it before because most proxies passing all the 
header data to client.

Hopefully this buggy server application can be fixed soon.

Regards,
	Peter
-- 
Dr. Peter Bieringer                             Phone: +49-8102-895190
AERAsec Network Services and Security GmbH        Fax: +49-8102-895199
Wagenberger Strasse 1
D-85662 Hohenbrunn                       E-Mail: pbieringer@...asec.de
Germany                                Internet: http://www.aerasec.de