Yahoo! Messenger Auth Bypass Vulnerability

This advisory is being provided to you under the policy documented at http://www.wiretrip.net/rfp/policy.html.
You are encouraged to read this policy; however, in the interim, you have approximately 5 days to respond to this initial email.
This policy encourages open communication, and I look forward to working with you on resolving the problem detailed below.

---

I. BACKGROUND

Yahoo! Inc. is an American computer services company with a mission to
"be the most essential global Internet service for consumers and businesses".
It operates an Internet portal, including the popular Yahoo! Mail.
The global network of Yahoo! websites received 3.4 billion page views per day
on average as of October 2005.

Yahoo mail services when accessed via Yahoo! messenger are vulnerable to
information leakage and authentication bypass which is caused due to
improper caching of pages by the browser.

II. DESCRIPTION

When a user receives a new email, Yahoo messenger lets the user click a button to open his
mail account in the browser. During this process, it uses a URL to login to yahoo. This
url then redirects the user to his mail box.

The URL mentioned above is not tied with a session (Same URL can be used any number of times).

Response to this URL does not specify that the browser should not keep its entry in the cache.
Therefore, even after the user logs out of both messenger and email account, the URL entry
still remains in the browser cache. Even after restarting the browser, this URL can be retrieved
from the cache.

Malicious users can easily access browser cache and grab this URL. He can thus login to
victim's Yahoo account without needing his credentials.

The URL looks like following
http://msg.edit.yahoo.com/config/reset_cookies?&.y=Y=v=XXXXXXXX&.t=T=z=YYYYYYYYYYYY&.ver=2&.done=http%3a//us.rd.yahoo.com/messenger/client/%3fhttp%3a//mail.yahoo.com/

III. ANALYSIS

Successful exploitation of this vulnerability would allow an attacker to get ACTIVE
access to victim's account. Attacker can therefore impersonate the victim and
misuse the account.

IV. DETECTION

Latest version of Yahoo! messenger is found vulnerable.

V. WORKAROUND

Response to the URL mentioned above should not get cached and should not remain in the
cache record of the browser.

This URL should be requested over secure http in order to avoid leaking of the URL at
several intermediate caches.

VI. VENDOR RESPONSE
??

VII. CVE INFORMATION
??

VIII. DISCLOSURE TIMELINE

11/22/2006 Initial vendor notification

??/??/??Initial vendor response

??/??/??Coordinated public disclosure

IX. CREDIT

Kishor Datar ( kishor [a_t] cenzic.com )
Cenzic Inc.

X. REFERENCES
Rajesh Sethumadhavan
http://searchsecurity.discussions.techtarget.com/[email protected]@.ee84078/463!enclosure=.1dd0ab61

XI. LEGAL NOTICES

Copyright ©

Permission is granted for the redistribution of this alert electronically. It may not be edited
in any way without the express written consent of Cenzic. If you wish to reprint the whole or
any part of this alert in any other medium other than electronically, please email for permission.

Disclaimer: The information in the advisory is believed to be accurate at the time of publishing
based on currently available information. Use of the information constitutes acceptance for use
in an AS IS condition. There are no warranties with regard to this information. Neither the author
nor the publisher accepts any liability for any direct, indirect, or consequential loss or damage
arising from use of, or reliance on, this information.