Vulnwatch: Nate User Password Disclosed By Anonymous

From: saintlinu <saintlinu_at_yahoo.co.kr>
Date: Fri, 5 Aug 2005 10:55:56 +0800

Dear lists

----------------------[Cut Cut]---------------------------------------------

Title: Nate User Password Disclosed By Anonymous

Discoverer: PARK, GYU TAE (saintlinu_at_null2root.org)

Advisory No.: NRVA05-06

Critical: High Critical

Impact: User Information disclosed by unauthorized user

Where: From remote

Operating System: N / A

Solution: Patched

Workaround: N / A

Notice: 08. 01. 2005 Initiate notified

08. 04. 2005 Vendor responded and patched

08. 05. 2005 Disclosure vulnerability

Description:

The Nate is portal service such as MSN, YAHOO on the Web in KOREA.

And interlocked NateOn Messenger (See a NRVA05-02)

When user requests URI on the NateWeb then shown up just like HTML document

but particular URI had included DEBUG CODE for Web-Programmer

Unfortunately DEBUG CODE is an USER'S INFORMATION like password

See following detail describe:

NOT INCLUDED HERE

----------------------[Cut Cut]---------------------------------------------

Cheers

________________________________________________________
무료 1GB용량!, 더 이상 용량 고민없는 - 야후! 메일 (http://mail.yahoo.co.kr)
최신 휴대폰 정보, 벨소리, 캐릭터, 문자메세지 - 야후! 모바일 (http://kr.mobile.yahoo.com)
대한민국 블로그가 모인 곳! - 야후! 피플링(http://kr.ring.yahoo.com)
Received on Aug 05 2005