[VulnWatch] Nate User Password Disclosed By Anonymous
From: saintlinu (saintlinu_at_yahoo.co.kr)
Date: 08/05/05
- Previous message: iDEFENSE Labs: "[VulnWatch] iDEFENSE Security Advisory 08.02.05: CA BrightStor ARCserve Backup Agent for MS SQL Server Buffer Overflow"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
To: <bugtraq@securityfocus.com>, <vulnwatch@vulnwatch.org>, <full-disclosure@lists.grok.org.uk> Date: Fri, 5 Aug 2005 10:55:56 +0800
Dear lists
----------------------[Cut Cut]---------------------------------------------
Title: Nate User Password Disclosed By Anonymous
Discoverer: PARK, GYU TAE (saintlinu@null2root.org)
Advisory No.: NRVA05-06
Critical: High Critical
Impact: User Information disclosed by unauthorized user
Where: From remote
Operating System: N / A
Solution: Patched
Workaround: N / A
Notice: 08. 01. 2005 Initiate notified
08. 04. 2005 Vendor responded and patched
08. 05. 2005 Disclosure vulnerability
Description:
The Nate is portal service such as MSN, YAHOO on the Web in KOREA.
And interlocked NateOn Messenger (See a NRVA05-02)
When user requests URI on the NateWeb then shown up just like HTML document
but particular URI had included DEBUG CODE for Web-Programmer
Unfortunately DEBUG CODE is an USER'S INFORMATION like password
See following detail describe:
NOT INCLUDED HERE
----------------------[Cut Cut]---------------------------------------------
Cheers
________________________________________________________
무료 1GB용량!, 더 이상 용량 고민없는 - 야후! 메일 (http://mail.yahoo.co.kr)
최신 휴대폰 정보, 벨소리, 캐릭터, 문자메세지 - 야후! 모바일 (http://kr.mobile.yahoo.com)
대한민국 블로그가 모인 곳! - 야후! 피플링(http://kr.ring.yahoo.com)
- Previous message: iDEFENSE Labs: "[VulnWatch] iDEFENSE Security Advisory 08.02.05: CA BrightStor ARCserve Backup Agent for MS SQL Server Buffer Overflow"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
