Trillian Saves Yahoo! Password in Plain Text to Local Temporary File in Certain Cases
|
|
SecurityTracker Alert ID: 1009745 |
|
SecurityTracker URL: http://securitytracker.com/id/1009745
|
|
CVE Reference:
GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Apr 13 2004
|
Impact:
Disclosure of authentication information
|
Exploit Included: Yes
|
|
Description:
Rafel Ivgi (The-Insider) reported a vulnerability in Trillian (when used with Yahoo! Messenger services). A local user can obtain the target user's password.
It is reported that when a Yahoo! Messenger user receives an e-mail via Yahoo! mail, the system will display a pop-up window to prompt the target user to check their mail. If the prompt is selected, the system reportedly writes an HTML file containing the target user's Yahoo! password to the Windows temporary folder. The system also reportedly saves the "Remmeber me" login credentials without prompting for the user's approval. The information is transmitted without session security (i.e., over HTTP), the report said.
|
Impact:
A local user can obtain a target user's Yahoo! password in certain cases.
|
Solution:
No solution was available at the time of this entry.
|
Vendor URL: www.trillian.cc/ (Links to External Site)
|
Cause:
Access control error, State error
|
Underlying OS:
Windows (Any)
|
|
Message History:
None.
|
Source Message Contents
|
Date: Tue, 13 Apr 2004 01:24:19 +0200
Subject: Yahoo! Messenger 5.6 & Trillian (All Versions) - User Credential
|
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Application: Yahoo! Messenger 5.6 & Trillian (All Versions)
Vendors: http://messenger.yahoo.com/
Platforms: Windows
Bug: User Credential Disclosure Vulnerability
Risk: Medium
Exploitation: Local - (or remote by sniffing)
Date: 1 Apr 2004
Author: Rafel Ivgi, The-Insider
e-mail: the_insider@mail.com
web: http://theinsider.deep-ice.com
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
1) Introduction
2) Bugs
3) The Code
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
===============
1) Introduction
===============
Yahoo! Messenger one of the worlds most common, secure and easy to
use instant messangers.
You can stay connected to Yahoo! Messenger on your mobile phone
and message your mobile friends from your PC. More info Super Webcam
Enjoy high-quality, broadband video messaging with your friends! More info
New Emoticons Express yourself in whole new ways without writing a word!
See them all IMVironments More IMVironments than ever before. (PC only)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
======
2) Bug
======
While using Yahoo Messanger a user recieves mail to his yahoo inbox.
Yahoo Messanger as well as Trillian pop-up a message box that allows
the user to check his mail box.
Upon clicking this message box a temporary html file is dumped to windows
temp folder. This html file contains the username and the PASSWORD of the
users yahoo account, in PLAIN TEXT format.
In addition to that it sets up the "Remmeber me" option which saves the
login cookie
which contains the login credentials - WITHOUT ASKING THE USER.
More over the connection opened uses standard HTTP protocol(which the
username
and password can be sniffed) instead of using the secure SSL login which is
supported
by yahoo.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
===========
3) The Code
===========
This is Proof Of Concept Code(the "temp" file which is generated):
------------------- CUT HERE -------------------
<html>
<head>
<script>
<!--
var username;
username='<username>';
var password;
password='<password>';
function submit () {
document.getElementById('login').value=username;
document.getElementById('passwd').value=password;
document.getElementById('login_form').submit();
};
//-->
</script>
</head>
<body onLoad='submit();'>
<form method=post action="https://login.yahoo.com/config/login"
autocomplete=off name=login_form id=login_form onsubmit="return
alert(document.forms['login_form'].login.value)">
<input type="hidden" name=".tries" value="1">
<input type="hidden" name=".src" value="ym">
<input type="hidden" name=".md5" value="">
<input type="hidden" name=".hash" value="">
<input type="hidden" name=".js" value="">
<input type="hidden" name=".last" value="2">
<input type="hidden" name="promo" value="">
<input type="hidden" name=".intl" value="us">
<input type="hidden" name=".bypass" value="">
<input type="hidden" name=".partner" value="">
<input type="hidden" name=".v" value="0">
<input type="hidden" name=".yplus" value="">
<input type="hidden" name=".emailCode" value="">
<input type="hidden" name="plg" value="">
<input type="hidden" name="stepid" value="">
<input type="hidden" name=".ev" value="">
<input type="hidden" name="hasMsgr" value="0">
<input type="hidden" name=".chkP" value="Y">
<input type="hidden" name=".done" value="http://mail.yahoo.com">
<input type="hidden" id="login" name="login" size="17" value="">
<input type="hidden" name="passwd" id="passwd" size="17" maxlength="32">
<input type="hidden" name=".save" value="Sign In">
</form></body>
</html>
------------------- CUT HERE -------------------
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
---
Rafel Ivgi, The-Insider
http://theinsider.deep-ice.com
"Only the one who sees the invisible , Can do the Impossible."
|
|
