[NT] Yahoo! Messenger Server Race Condition Vulnerability
SecuriTeam <[email protected]>
| Newsgroups | gmane.comp.security.securiteam |
|---|---|
| Message-ID | <[email protected]> |
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com - - promotion The SecuriTeam alerts list - Free, Accurate, Independent. Get your security news from a reliable source. http://www.securiteam.com/mailinglist.html - - - - - - - - - Yahoo! Messenger Server Race Condition Vulnerability ------------------------------------------------------------------------ SUMMARY A vulnerability exists in Yahoo!'s Chat servers allows chatters to be added to your friends list completely without their knowledge or authorization. As a result private status messages can be read and on-line Yahoo! Chat activity can be monitored stealthily. DETAILS Vulnerable Systems: * Yahoo! Messenger 6.0 * Yahoo! Messenger 5.0 * Yahoo! Messenger Server A feature that can be found in Yahoo! Messenger under the Contacts tab, "Invite People to Yahoo! Messenger..." and under the "Add people" option contains a loophole that allows for a person to be added to another person's friends list completely without their knowledge or consent. This feature allows for an e-mail to be sent (through Yahoo!'s HTTP servers) inviting another person to download and use Yahoo! Messenger. In the e-mail (generated from the template) is a vulnerable link that can be altered to the attacker liking. By specifying an e-mail address different from the yahoo.com domain names attackers can view the template responsible for generating this link and sending the e-mails. Once the link is tweaked all the attackers need to do is plug it into their browser's address bar and sign into the Yahoo! account that they want the target to be added as a friend on. Once signed in the operation is completed.. no user-interaction required. If the attackers already signed into yahoo.com then by simply tweaking the link and surfing to it will complete the operation for them. Yahoo! is tricked into thinking that a person received an e-mailed invitation permitting them to add the sender as a friend, and as the result no add buddy request confirmation is ever sent to the id being added (the supposed "sender" of this e-mail), exploiting a trust-based relationship. No e-mail needs to be sent (no invitation) to accomplish this since the attackers already knows the link and the e-mail would in fact give the users away (since then the receiver could add 'US' without the user knowledge and make them aware of the invitation in the first place - raising suspicion of the whole intent of the actual invitation). Proof of Concept: 1. Skip Add Buddy "Accept" step and add immediately with no steps after signing in: http://friends.msg.yahoo.com/invite?id=ID_TO_ADD&intl=us&op=add&dl=1 2. Go through with Add Buddy "Accept" step and add after confirmation of the operation: http://friends.msg.yahoo.com/invite?op=accept&id=ID_TO_ADD&intl=us Where "ID_TO_ADD" would be the id of the person you're wanting to add to your Yahoo! account that you'd be signing into from these links. Successful exploitation attackers can monitor the online activity of the users that was added by others without permission. Attackers can determine whether or not the users are "Available" and read their custom status messages that could contain private information such as private links and text (phone numbers, away messages etc). ADDITIONAL INFORMATION The information has been provided by <mailto:[email protected]> Torseq Tech. ======================================== This bulletin is sent to members of the SecuriTeam mailing list. To unsubscribe from the list, send mail with an empty subject line and body to: [email protected] In order to subscribe to the mailing list, simply forward this email to: [email protected] ==================== ==================== DISCLAIMER: The information in this bulletin is provided "AS IS" without warranty of any kind. In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.