Full Disclosure mailing list archives
Re: Yahoo! Messenger 5.6 & Trillian (All Versions) - User Credential Disclosure Vulnerability
From: 3APA3A <3APA3A () SECURITY NNOV RU>
Date: Tue, 13 Apr 2004 16:08:06 +0400
Dear Rafel Ivgi, The-Insider, I see no "Medium" risk here. Under Windows 2000 and above TEMP points to user's profile and user's profile is secured with NTFS permissions, and it's impossible for unprivileged user to read it. If you use FAT or user has admin privileges there is a lot of ways to obtain password. --Tuesday, April 13, 2004, 3:24:19 AM, you wrote to bugtraq () securityfocus com: RITI> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ RITI> Application: Yahoo! Messenger 5.6 & Trillian (All Versions) RITI> Vendors: http://messenger.yahoo.com/ RITI> Platforms: Windows RITI> Bug: User Credential Disclosure Vulnerability RITI> Risk: Medium RITI> Exploitation: Local - (or remote by sniffing) RITI> Date: 1 Apr 2004 RITI> Author: Rafel Ivgi, The-Insider RITI> e-mail: the_insider () mail com RITI> web: http://theinsider.deep-ice.com RITI> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ RITI> 1) Introduction RITI> 2) Bugs RITI> 3) The Code RITI> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ RITI> =============== RITI> 1) Introduction RITI> =============== RITI> Yahoo! Messenger one of the worlds most common, secure and easy to RITI> use instant messangers. RITI> You can stay connected to Yahoo! Messenger on your mobile phone RITI> and message your mobile friends from your PC. More info Super Webcam RITI> Enjoy high-quality, broadband video messaging with your friends! More info RITI> New Emoticons Express yourself in whole new ways without writing a word! RITI> See them all IMVironments More IMVironments than ever before. (PC only) RITI> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ RITI> ====== RITI> 2) Bug RITI> ====== RITI> While using Yahoo Messanger a user recieves mail to his yahoo inbox. RITI> Yahoo Messanger as well as Trillian pop-up a message box that allows RITI> the user to check his mail box. RITI> Upon clicking this message box a temporary html file is dumped to windows RITI> temp folder. This html file contains the username and the PASSWORD of the RITI> users yahoo account, in PLAIN TEXT format. RITI> In addition to that it sets up the "Remmeber me" option which saves the RITI> login cookie RITI> which contains the login credentials - WITHOUT ASKING THE USER. RITI> More over the connection opened uses standard HTTP protocol(which the RITI> username RITI> and password can be sniffed) instead of using the secure SSL login which is RITI> supported RITI> by yahoo. RITI> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ RITI> =========== RITI> 3) The Code RITI> =========== RITI> This is Proof Of Concept Code(the "temp" file which is generated): RITI> ------------------- CUT HERE ------------------- RITI> <html> RITI> <head> RITI> <script> RITI> <!-- RITI> var username; RITI> username='<username>'; RITI> var password; RITI> password='<password>'; RITI> function submit () { RITI> document.getElementById('login').value=username; RITI> document.getElementById('passwd').value=password; RITI> document.getElementById('login_form').submit(); RITI> }; //-->> RITI> </script> RITI> </head> RITI> <body onLoad='submit();'> RITI> <form method=post action="https://login.yahoo.com/config/login" RITI> autocomplete=off name=login_form id=login_form onsubmit="return RITI> alert(document.forms['login_form'].login.value)"> RITI> <input type="hidden" name=".tries" value="1"> RITI> <input type="hidden" name=".src" value="ym"> RITI> <input type="hidden" name=".md5" value=""> RITI> <input type="hidden" name=".hash" value=""> RITI> <input type="hidden" name=".js" value=""> RITI> <input type="hidden" name=".last" value="2"> RITI> <input type="hidden" name="promo" value=""> RITI> <input type="hidden" name=".intl" value="us"> RITI> <input type="hidden" name=".bypass" value=""> RITI> <input type="hidden" name=".partner" value=""> RITI> <input type="hidden" name=".v" value="0"> RITI> <input type="hidden" name=".yplus" value=""> RITI> <input type="hidden" name=".emailCode" value=""> RITI> <input type="hidden" name="plg" value=""> RITI> <input type="hidden" name="stepid" value=""> RITI> <input type="hidden" name=".ev" value=""> RITI> <input type="hidden" name="hasMsgr" value="0"> RITI> <input type="hidden" name=".chkP" value="Y"> RITI> <input type="hidden" name=".done" value="http://mail.yahoo.com"> RITI> <input type="hidden" id="login" name="login" size="17" value=""> RITI> <input type="hidden" name="passwd" id="passwd" size="17" maxlength="32"> RITI> <input type="hidden" name=".save" value="Sign In"> RITI> </form></body> RITI> </html> RITI> ------------------- CUT HERE ------------------- RITI> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ RITI> --- RITI> Rafel Ivgi, The-Insider RITI> http://theinsider.deep-ice.com RITI> "Only the one who sees the invisible , Can do the Impossible." RITI> _______________________________________________ RITI> Full-Disclosure - We believe in it. RITI> Charter: http://lists.netsys.com/full-disclosure-charter.html -- ~/ZARAZA Пишите еще. И если в вашей петиции имелся какой-нибудь смысл, то, не стесняясь, разъясните в чем дело. (Твен) _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- Yahoo! Messenger 5.6 & Trillian (All Versions) - User Credential Disclosure Vulnerability Rafel Ivgi, The-Insider (Apr 12)
- Re: Yahoo! Messenger 5.6 & Trillian (All Versions) - User Credential Disclosure Vulnerability 3APA3A (Apr 13)
- Decode Messenger conversations from logs Dean (Apr 13)
- RE: Decode Messenger conversations from logs Richard M. Smith (Apr 13)
- New Microsoft Patches have just been published on the web! Exibar (Apr 13)
- RE: Decode Messenger conversations from logs Bill Royds (Apr 13)
- Re: Decode Messenger conversations from logs Dean (Apr 14)
- Decode Messenger conversations from logs Dean (Apr 13)
- Re: Yahoo! Messenger 5.6 & Trillian (All Versions) - User Credential Disclosure Vulnerability 3APA3A (Apr 13)