Full Disclosure mailing list archives

Contact to webmaster of messages.yahoo.com - bbs application sends broken HTTP header

From: Peter Bieringer <pbieringer () aerasec de>
Date: Fri, 30 Sep 2005 17:04:20 +0200

Hi,

it's not really security related, but it looks like it is impossible tofind a contact address.

Reason for contact is that while using a more strict content filter engine(WebWasher) between client and server we found that "bbs" application onmessages.yahoo.com send broken HTTP header:


Debug:
# ngrep -d <interface> 'GET|HTTP' host messages.yahoo.com

Request:

$ curl --compress -A "Mozilla/5.0" -D header.txt -o body.txt"http://messages.yahoo.com/bbs?action=q&board=TSG";


Client on address 84.153.90.***

All works fine:

HTTP/1.1 200 OK
Date: Fri, 30 Sep 2005 14:09:14 GMT

Cache-Control: private
Connection: close
Transfer-Encoding: chunked
Content-Type: text/html
Content-Encoding: gzip

Set-Cookie: B=5fjrc551jqhoa&b=3&s=7r; expires=Tue, 02-Jun-2037 20:00:00GMT; path=/; domain=.yahoo.com



Clients behind other addresses (located in Germany):

HTTP/1.1 200 OK
Date: Fri, 30 Sep 2005 14:05:25 GMT

P3P: policyref="http://p3p.yahoo.com/w3c/p3p.xml";, CP="CAO DSP COR CUR ADMDEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi INDPHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV"P3P: policyref="http://p3p.yahoo.com/w3c/p3p.xml";, CP="CAO DSP COR CUR ADMDEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi INDPHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV"Location:http://edit.my.yahoo.com/config/login?.src=mb&.done=messages.yahoo.com&lg=us&.intl=us

Cache-Control
<broken content, reproducable, always here>


Without requesting compression:

$ curl -A "Mozilla/5.0" -D header.txt -o body.txt"http://messages.yahoo.com/bbs?action=q&board=TSG";


HTTP/1.1 200 OK
Date: Fri, 30 Sep 2005 14:22:00 GMT
P3P: policyref="http://p3p.yahoo.com/w3c/p3p.xml";, CP="CAO DSP COR CUR

ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBiIND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV"P3P: policyref="http://p3p.yahoo.com/w3c/p3p.xml";, CP="CAO DSP COR CUR ADMDEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi INDPHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV"

Location: http://edit.my.yahoo.com/config/login?.src=mb&.done=me36da
hoo.com&lg=us&.intl=us
Connection: close
Transfer-Encoding: chunked, chunked
Content-Type: text/html

Set-Cookie: B=4a94ep91jqig8&b=3&s=6n; expires=Tue, 02-Jun-2037 20:00:00GMT; path=/; domain=.yahoo.com


<html>....


Note here the improper header Transfer-Encoding value "chunked, chunked"
and broken Location-Header (CR/LF inbetween).

Perhaps nobody has detected it before because most proxies passing all theheader data to client.


Hopefully this buggy server application can be fixed soon.

Regards,
        Peter
--
Dr. Peter Bieringer                             Phone: +49-8102-895190
AERAsec Network Services and Security GmbH        Fax: +49-8102-895199
Wagenberger Strasse 1
D-85662 Hohenbrunn                       E-Mail: pbieringer () aerasec de
Germany                                Internet: http://www.aerasec.de

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Current thread:

Contact to webmaster of messages.yahoo.com - bbs application sends broken HTTP header Peter Bieringer (Sep 30)