Re: [Full-Disclosure] Yahoo! Messenger 5.6 & Trillian (All Versions) - User Credential Disclosure Vulnerability

From: 3APA3A (3APA3A_at_SECURITY.NNOV.RU)
Date: 04/13/04

  • Next message: Dean: "[Full-Disclosure] Decode Messenger conversations from logs" 
    To: "Rafel Ivgi, The-Insider" <theinsider@012.net.il>
Date: Tue, 13 Apr 2004 16:08:06 +0400

    Dear Rafel Ivgi, The-Insider,

    I see no "Medium" risk here. Under Windows 2000 and above TEMP points to
    user's profile and user's profile is secured with NTFS permissions, and
    it's impossible for unprivileged user to read it. If you use FAT or user
    has admin privileges there is a lot of ways to obtain password.

    --Tuesday, April 13, 2004, 3:24:19 AM, you wrote to bugtraq@securityfocus.com:

    RITI> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    RITI> Application: Yahoo! Messenger 5.6 & Trillian (All Versions)
    RITI> Vendors: http://messenger.yahoo.com/
    RITI> Platforms: Windows
    RITI> Bug: User Credential Disclosure Vulnerability
    RITI> Risk: Medium
    RITI> Exploitation: Local - (or remote by sniffing)
    RITI> Date: 1 Apr 2004
    RITI> Author: Rafel Ivgi, The-Insider
    RITI> e-mail: the_insider@mail.com
    RITI> web: http://theinsider.deep-ice.com

    RITI> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    RITI> 1) Introduction
    RITI> 2) Bugs
    RITI> 3) The Code

    RITI> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    RITI> ===============
    RITI> 1) Introduction
    RITI> ===============

    RITI> Yahoo! Messenger one of the worlds most common, secure and easy to
    RITI> use instant messangers.
    RITI> You can stay connected to Yahoo! Messenger on your mobile phone
    RITI> and message your mobile friends from your PC. More info Super Webcam
    RITI> Enjoy high-quality, broadband video messaging with your friends! More info
    RITI> New Emoticons Express yourself in whole new ways without writing a word!
    RITI> See them all IMVironments More IMVironments than ever before. (PC only)

    RITI> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    RITI> ======
    RITI> 2) Bug
    RITI> ======

    RITI> While using Yahoo Messanger a user recieves mail to his yahoo inbox.
    RITI> Yahoo Messanger as well as Trillian pop-up a message box that allows
    RITI> the user to check his mail box.

    RITI> Upon clicking this message box a temporary html file is dumped to windows
    RITI> temp folder. This html file contains the username and the PASSWORD of the
    RITI> users yahoo account, in PLAIN TEXT format.

    RITI> In addition to that it sets up the "Remmeber me" option which saves the
    RITI> login cookie
    RITI> which contains the login credentials - WITHOUT ASKING THE USER.

    RITI> More over the connection opened uses standard HTTP protocol(which the
    RITI> username
    RITI> and password can be sniffed) instead of using the secure SSL login which is
    RITI> supported
    RITI> by yahoo.

    RITI> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    RITI> ===========
    RITI> 3) The Code
    RITI> ===========

    RITI> This is Proof Of Concept Code(the "temp" file which is generated):
    RITI> ------------------- CUT HERE -------------------
    RITI> <html>
    RITI> <head>
    RITI> <script>
    RITI> <!--

    RITI> var username;

    RITI> username='<username>';

    RITI> var password;

    RITI> password='<password>';

    RITI> function submit () {

    RITI> document.getElementById('login').value=username;

    RITI> document.getElementById('passwd').value=password;

    RITI> document.getElementById('login_form').submit();

    RITI> };

    //-->>

    RITI> </script>

    RITI> </head>

    RITI> <body onLoad='submit();'>

    RITI> <form method=post action="https://login.yahoo.com/config/login"
    RITI> autocomplete=off name=login_form id=login_form onsubmit="return
    RITI> alert(document.forms['login_form'].login.value)">

    RITI> <input type="hidden" name=".tries" value="1">
    RITI> <input type="hidden" name=".src" value="ym">
    RITI> <input type="hidden" name=".md5" value="">
    RITI> <input type="hidden" name=".hash" value="">
    RITI> <input type="hidden" name=".js" value="">
    RITI> <input type="hidden" name=".last" value="2">
    RITI> <input type="hidden" name="promo" value="">
    RITI> <input type="hidden" name=".intl" value="us">
    RITI> <input type="hidden" name=".bypass" value="">
    RITI> <input type="hidden" name=".partner" value="">
    RITI> <input type="hidden" name=".v" value="0">
    RITI> <input type="hidden" name=".yplus" value="">
    RITI> <input type="hidden" name=".emailCode" value="">
    RITI> <input type="hidden" name="plg" value="">
    RITI> <input type="hidden" name="stepid" value="">
    RITI> <input type="hidden" name=".ev" value="">
    RITI> <input type="hidden" name="hasMsgr" value="0">
    RITI> <input type="hidden" name=".chkP" value="Y">
    RITI> <input type="hidden" name=".done" value="http://mail.yahoo.com">
    RITI> <input type="hidden" id="login" name="login" size="17" value="">

    RITI> <input type="hidden" name="passwd" id="passwd" size="17" maxlength="32">

    RITI> <input type="hidden" name=".save" value="Sign In">
    RITI> </form></body>
    RITI> </html>
    RITI> ------------------- CUT HERE -------------------

    RITI> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    RITI> ---
    RITI> Rafel Ivgi, The-Insider
    RITI> http://theinsider.deep-ice.com

    RITI> "Only the one who sees the invisible , Can do the Impossible."

    RITI> _______________________________________________
    RITI> Full-Disclosure - We believe in it.
    RITI> Charter: http://lists.netsys.com/full-disclosure-charter.html 

    -- 
~/ZARAZA
Пишите еще. И если в вашей петиции имелся какой-нибудь
смысл, то, не стесняясь, разъясните в чем дело. (Твен)
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html
  • Next message: Dean: "[Full-Disclosure] Decode Messenger conversations from logs"
    • Quantcast