mailing list archives
[BMSA-2011-02] Cross site scripting in Yahoo! Pulse
From: Nam Nguyen <namn () bluemoon com vn>
Date: Wed, 18 May 2011 08:23:18 +0700
BLUE MOON SECURITY ADVISORY 2011-02
:Title: Cross site scripting vulnerability in Yahoo! Pulse
:Reporter: Thinh Q. Hoang and Blue Moon Consulting
:Products: Yahoo! Pulse
:Fixed in: latest version
Yahoo! Pulse is a new Yahoo! product that allows you to keep in touch with your friends. We’ve made it easier to stay
connected to the people who matter most and share what’s important!
Yahoo! Pulse suffers from a XSS vulnerability in its photo upload feature. If the file's name is ``junk"
There is no workaround.
A fix has been rolled out by Yahoo!.
Blue Moon Consulting adapts `RFPolicy v2.0 <http://www.wiretrip.net/rfp/policy.html>`_ in notifying vendors.
:Initial vendor contact:
May 10, 2011: Initial query sent to Yahoo! Security Team (YST).
May 11, 2011: YST asked for steps to reproduce the bug.
May 11, 2011: Details sent to YST, encrypted.
May 12, 2011: YST sent a reply, encrypted with their PUBLIC key!
May 12, 2011: Request sent to YST to re-send the last message.
May 13, 2011: YST re-sent the last message.
May 16, 2011: YST informed us the bug was fixed.
May 17, 2011: Confirmation sent to YST.
:Public disclosure: May 18, 2011
No exploit code required.
The information provided in this advisory is provided "as is" without warranty of any kind. Blue Moon Consulting Co.,
Ltd disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a
particular purpose. Your use of the information on the advisory or materials linked from the advisory is at your own
risk. Blue Moon Consulting Co., Ltd reserves the right to change or update this notice at any time.
Nam Nguyen, CISA, CISSP, CSSLP
Blue Moon Consulting Co., Ltd
Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia - http://secunia.com/
- [BMSA-2011-02] Cross site scripting in Yahoo! Pulse Nam Nguyen (May 18)