YABB information leakage on failed login
YABB is a popular web-based bulletin board system, written in perl and
available from <http://www.yabbforum.com/>. While evaluating it, I
found a minor issue where an attacker trying to log in to the forums can
extract some useful information making his job easier than it needs to
be.
Most YABB forums allow 'guest' users to browse postings, but some
require users to log in. As this only applies in that latter case, the
impact of this vulnerability is low.
I have only looked at YABB version 1, SP 1.3.1.
In normal user login systems, such as the Unix login, any login failure
simply results in a message telling the user that he was unsuccessful,
but without saying whether the username was bogus or the password was
bogus. When trying to log in to YABB with a bogus username the user is
told that the username is incorrect. When trying to log in with a good
username but the wrong password, the user is told that the password is
incorrect. This means that an attacker has to guess less information.
The YABB developers were informed of this on 2004-02-05 via sourceforge
and a patch submitted. There has not yet been a response.
--
David Cantrell
Planckton: n, the smallest possible living thing