Hi,
it's not really security related, but it looks like it is impossible to
find a contact address.
Reason for contact is that while using a more strict content filter engine
(WebWasher) between client and server we found that "bbs" application on
messages.yahoo.com send broken HTTP header:
Debug:
# ngrep -d <interface> 'GET|HTTP' host messages.yahoo.com
Request:
$ curl --compress -A "Mozilla/5.0" -D header.txt -o body.txt
"http://messages.yahoo.com/bbs?action=q&board=TSG";
Client on address 84.153.90.***
All works fine:
HTTP/1.1 200 OK
Date: Fri, 30 Sep 2005 14:09:14 GMT
P3P: policyref="http://p3p.yahoo.com/w3c/p3p.xml";, CP="CAO DSP COR CUR ADM
DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND
PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV"
Cache-Control: private
Connection: close
Transfer-Encoding: chunked
Content-Type: text/html
Content-Encoding: gzip
Set-Cookie: B=5fjrc551jqhoa&b=3&s=7r; expires=Tue, 02-Jun-2037 20:00:00
GMT; path=/; domain=.yahoo.com
Clients behind other addresses (located in Germany):
HTTP/1.1 200 OK
Date: Fri, 30 Sep 2005 14:05:25 GMT
P3P: policyref="http://p3p.yahoo.com/w3c/p3p.xml";, CP="CAO DSP COR CUR ADM
DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND
PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV"
P3P: policyref="http://p3p.yahoo.com/w3c/p3p.xml";, CP="CAO DSP COR CUR ADM
DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND
PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV"
Location:
http://edit.my.yahoo.com/config/login?.src=mb&.done=messages.yahoo.com&lg=us&.intl=us
Cache-Control
<broken content, reproducable, always here>
Without requesting compression:
$ curl -A "Mozilla/5.0" -D header.txt -o body.txt
"http://messages.yahoo.com/bbs?action=q&board=TSG";
HTTP/1.1 200 OK
Date: Fri, 30 Sep 2005 14:22:00 GMT
P3P: policyref="http://p3p.yahoo.com/w3c/p3p.xml";, CP="CAO DSP COR CUR
ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi
IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV"
P3P: policyref="http://p3p.yahoo.com/w3c/p3p.xml";, CP="CAO DSP COR CUR ADM
DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND
PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV"
Location: http://edit.my.yahoo.com/config/login?.src=mb&.done=me36da
hoo.com&lg=us&.intl=us
Connection: close
Transfer-Encoding: chunked, chunked
Content-Type: text/html
Set-Cookie: B=4a94ep91jqig8&b=3&s=6n; expires=Tue, 02-Jun-2037 20:00:00
GMT; path=/; domain=.yahoo.com
<html>....
Note here the improper header Transfer-Encoding value "chunked, chunked"
and broken Location-Header (CR/LF inbetween).
Perhaps nobody has detected it before because most proxies passing all the
header data to client.
Hopefully this buggy server application can be fixed soon.
Regards,
Peter
--
Dr. Peter Bieringer Phone: +49-8102-895190
AERAsec Network Services and Security GmbH Fax: +49-8102-895199
Wagenberger Strasse 1
D-85662 Hohenbrunn E-Mail: pbieringer@aerasec.de
Germany Internet: http://www.aerasec.de
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
