Nate User Password Disclosed By Anonymous

"saintlinu" <[email protected]> Fri, 5 Aug 2005 10:55:56 +0800

Newsgroups	gmane.comp.security.vulnerabilities.watch.announce,gmane.comp.security.bugtraq,gmane.comp.security.full-disclosure
Message-ID	<[email protected]>

Dear lists

 

----------------------[Cut Cut]---------------------------------------------

Title:             Nate User Password Disclosed By Anonymous

Discoverer:        PARK, GYU TAE ([email protected])

Advisory No.:      NRVA05-06

Critical:          High Critical

Impact:            User Information disclosed by unauthorized user

Where:             From remote

Operating System:  N / A

Solution:          Patched

Workaround:        N / A

 

Notice:            08. 01. 2005 Initiate notified

                   08. 04. 2005 Vendor responded and patched

                   08. 05. 2005 Disclosure vulnerability

 

Description: 

The Nate is portal service such as MSN, YAHOO on the Web in KOREA.

And interlocked NateOn Messenger (See a NRVA05-02)

 

When user requests URI on the NateWeb then shown up just like HTML document

but particular URI had included DEBUG CODE for Web-Programmer

 

Unfortunately DEBUG CODE is an USER'S INFORMATION like password

 

 

See following detail describe:

 

NOT INCLUDED HERE

----------------------[Cut Cut]---------------------------------------------

 

Cheers