'[Full-disclosure] Contact to webmaster of messages.yahoo.com - bbs'

[prev in list] [next in list] [prev in thread] [next in thread] 

List:       full-disclosure
Subject:    [Full-disclosure] Contact to webmaster of messages.yahoo.com - bbs
From:       Peter Bieringer <pbieringer () aerasec ! de>
Date:       2005-09-30 15:04:20
Message-ID: 857EA8B35CDEF59B7251B718 () [10 ! 3 ! 62 ! 6]
[Download RAW message or body]

Hi,

it's not really security related, but it looks like it is impossible to 
find a contact address.

Reason for contact is that while using a more strict content filter engine 
(WebWasher) between client and server we found that "bbs" application on 
messages.yahoo.com send broken HTTP header:

Debug:
# ngrep -d <interface> 'GET|HTTP' host messages.yahoo.com

Request:
$ curl --compress -A "Mozilla/5.0" -D header.txt -o body.txt 
"http://messages.yahoo.com/bbs?action=q&board=TSG"

Client on address 84.153.90.***

All works fine:

HTTP/1.1 200 OK
Date: Fri, 30 Sep 2005 14:09:14 GMT
P3P: policyref="http://p3p.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM 
DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND 
PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV"
Cache-Control: private
Connection: close
Transfer-Encoding: chunked
Content-Type: text/html
Content-Encoding: gzip
Set-Cookie: B=5fjrc551jqhoa&b=3&s=7r; expires=Tue, 02-Jun-2037 20:00:00 
GMT; path=/; domain=.yahoo.com


Clients behind other addresses (located in Germany):

HTTP/1.1 200 OK
Date: Fri, 30 Sep 2005 14:05:25 GMT
P3P: policyref="http://p3p.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM 
DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND 
PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV"
P3P: policyref="http://p3p.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM 
DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND 
PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV"
Location: 
http://edit.my.yahoo.com/config/login?.src=mb&.done=messages.yahoo.com&lg=us&.intl=us
Cache-Control
<broken content, reproducable, always here>


Without requesting compression:

$ curl -A "Mozilla/5.0" -D header.txt -o body.txt 
"http://messages.yahoo.com/bbs?action=q&board=TSG"

HTTP/1.1 200 OK
Date: Fri, 30 Sep 2005 14:22:00 GMT
P3P: policyref="http://p3p.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR
 ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi 
IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV"
P3P: policyref="http://p3p.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM 
DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND 
PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV"
Location: http://edit.my.yahoo.com/config/login?.src=mb&.done=me36da
hoo.com&lg=us&.intl=us
Connection: close
Transfer-Encoding: chunked, chunked
Content-Type: text/html
Set-Cookie: B=4a94ep91jqig8&b=3&s=6n; expires=Tue, 02-Jun-2037 20:00:00 
GMT; path=/; domain=.yahoo.com

<html>....


Note here the improper header Transfer-Encoding value "chunked, chunked"
and broken Location-Header (CR/LF inbetween).

Perhaps nobody has detected it before because most proxies passing all the 
header data to client.

Hopefully this buggy server application can be fixed soon.

Regards,
	Peter
-- 
Dr. Peter Bieringer                             Phone: +49-8102-895190
AERAsec Network Services and Security GmbH        Fax: +49-8102-895199
Wagenberger Strasse 1
D-85662 Hohenbrunn                       E-Mail: pbieringer@aerasec.de
Germany                                Internet: http://www.aerasec.de

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
[prev in list] [next in list] [prev in thread] [next in thread]
Configure | About | News | Add a list | Sponsored by KoreLogic