YaBB Lets Remote Users Determine if User Accounts Exist on the Forum
|
|
SecurityTracker Alert ID: 1009559
|
|
CVE Reference: CAN-2004-0294
(Links to External Site)
|
Date: Mar 26 2004
|
Impact: Disclosure of user information
|
Exploit Included: Yes
|
Version(s): 1 SP 1.3.1
|
Description: An information disclosure vulnerability was reported in YaBB. A remote user can determine if a specified user account exists or not.
In February 2004, David Cantrell reported that when a remote user attempts to login to a forum and fails, the system will indicate
to the remote user whether the username was valid or not. If the username is valid and the password is not correct, the system
will reportedly indicate that the password was incorrect.
The vendor was reportedly notified on February 5, 2004.
|
Impact: A remote user can determine if user account names exist on the target system.
|
Solution: No solution was available at the time of this entry.
|
Vendor URL: www.yabbforum.com/ (Links to External Site)
|
Cause: Access control error, State error
|
Underlying OS: Linux (Any), UNIX (Any), Windows (Any)
|
Reported By: David Cantrell <david@cantrell.org.uk>
|
Message History:
None.
|
Source Message Contents
|
Date: Tue, 17 Feb 2004 10:07:48 +0000
From: David Cantrell <david@cantrell.org.uk>
Subject: YABB information leakage on failed login
|
YABB is a popular web-based bulletin board system, written in perl and
available from <http://www.yabbforum.com/>. While evaluating it, I
found a minor issue where an attacker trying to log in to the forums can
extract some useful information making his job easier than it needs to
be.
Most YABB forums allow 'guest' users to browse postings, but some
require users to log in. As this only applies in that latter case, the
impact of this vulnerability is low.
I have only looked at YABB version 1, SP 1.3.1.
In normal user login systems, such as the Unix login, any login failure
simply results in a message telling the user that he was unsuccessful,
but without saying whether the username was bogus or the password was
bogus. When trying to log in to YABB with a bogus username the user is
told that the username is incorrect. When trying to log in with a good
username but the wrong password, the user is told that the password is
incorrect. This means that an attacker has to guess less information.
The YABB developers were informed of this on 2004-02-05 via sourceforge
and a patch submitted. There has not yet been a response.
--
David Cantrell
Planckton: n, the smallest possible living thing
|
|
