Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email firstname.lastname@example.org
EEYE: Yahoo! Mail Account Filter Overflow Hijack
From: Drew Copley (dcopleyEEYE.COM)
Date: Wed Apr 21 2004 - 13:11:46 CDT
"Yahoo! Mail" Account Filter Overflow Hijack
April 19, 2004
March 10, 2004
"Yahoo! Mail" is one of the Internet's most popular
web based email solutions. They provide free email and
large capacity storage, as well as subscription-based
services such as mail forwarding, expanded storage and
personalized email addresses.
eEye Digital Security has discovered a security hole in
"Yahoo! Mail" which allows a remote attacker to take over
an account remotely by sending a specially crafted email.
[->a bunch of chars here [spaces are most stealth], the whole
file size will be just about 100KB]
[this causes the filter to not work... the code is then run
The pseudo-diagram above explains the scenario rather well.
For whatever reason, Yahoo's email filter simply does not
work on files which exceed a certain range. This kind of
software issue is relatively common.
A remarkable note about this bug is that no one seems to
have found it before.
As far as anyone knows.
Drew's Happy-Happy Quote for the Day:
Ben Franklin, "Three can keep a secret if two are dead."
Yahoo! Mail is a hosted, web based service, hence users
do not need to patch. Yahoo has already fixed this bug,
therefore all Yahoo accounts are now completely safe from
Yahoo! has been notified and has rectified the issue.
Drew Copley, eEye Digital Security (dcopley eeye.com), Research Engineer
thanks to "http-equiv" for additional research
Retina Network Security Scanner - Free 15 Day Trial
To all of you out there that don't use turn signals.
Sooner or later your time is going to come. And a special
greeting to all of these competitors of ours making some extra
cash by selling pre-fix vulnerabilities through pay for play
"mailing lists". I am sure North Korea, the Yakuza, the
"Triads", the Russian Mafiya, La Costa Nostra, and every
other criminal state or organization appreciates your type of
"Partial Full Disclosure for a Darn Good Price" motto.
Copyright (c) 1998-2004 eEye Digital Security
Permission is hereby granted for the redistribution of this
alert electronically. It is not to be edited in any way without
express consent of eEye. If you wish to reprint the whole or
any part of this alert in any other medium excluding electronic
medium, please email alerteEye.com for permission.
The information within this paper may change without notice.
Use of this information constitutes acceptance for use in an
AS IS condition. There are no warranties, implied or express,
with regard to this information. In no event shall the author
be liable for any direct or indirect damages whatsoever arising
out of or in connection with the use or spread of this information.
Any use of this information is at the user's own risk.
Please send suggestions, updates, and comments to:
eEye Digital Security
Earn up to 10 credit course hours toward the TruSecure ICSA Practitioner (TICSA) Credential and receive a TICSA exam coupon by attending the Infosecurity Canada 2004 conference. Featured speaker, Marcus J. Ranum, TruSecure inventor of the proxy firewall will present on June 3 at 11:30 AM. Visit <https://ticsa.trusecure.com> for certification details and <http://www.infosecuritycanada.com> for conference information. Become TICSA certified and see what happens!