YaBB 1 Gold Multiple Input Validation Vulnerabilities

Bugtraq ID:	11235
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Sep 22 2004 12:00AM
Updated:	Sep 22 2004 12:00AM
Credit:	The individual responsible for the discovery of these issues is currently unknown; the vendor disclosed these issues.
Vulnerable:	YaBB YaBB 1 Gold Release - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 YaBB YaBB 1 Gold - SP 1.3.1 YaBB YaBB 1 Gold - SP 1.3 YaBB YaBB 1 Gold - SP 1.2 YaBB YaBB 1 Gold - SP 1 - Apache Apache 1.3.22 - Apache Apache 1.3.20 - Apache Apache 1.3.20 - Apache Apache 1.3.19 - Apache Apache 1.3.19 - Apache Apache 1.3.18 - Apache Apache 1.3.18 - Apache Apache 1.3.17 - Apache Apache 1.3.17 - Microsoft IIS 5.0 - Microsoft IIS 4.0 - Omnicron OmniHTTPD 2.4 Pro
Not Vulnerable:	YaBB YaBB 1 Gold - SP 1.3.2

YaBB 1 Gold Multiple Input Validation Vulnerabilities

YaBB 1 Gold is affected by multiple input validation vulnerabilities. These issues are due to a failure of the application to properly sanitize user-supplied input.

An attacker may leverage a cross-site scripting issue to execute arbitrary HTML and script code in the browser of an unsuspecting user in the context of the vulnerable site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

An attacker may exploit a HTTP response splitting issue to manipulate or misrepresent pages in the context of the vulnerable site, potentially facilitating phishing attacks.

YaBB 1 Gold Multiple Input Validation Vulnerabilities

No exploit is required to leverage these issues.

YaBB 1 Gold Multiple Input Validation Vulnerabilities

Solution:
The vendor has released an upgrade dealing with this issue.


YaBB YaBB 1 Gold - SP 1.3.1

• YaBB 1 Gold - SP 1.3.2
  http://www.yabbforum.com/downloads.php

YaBB YaBB 1 Gold - SP 1

• YaBB 1 Gold - SP 1.3.2
  http://www.yabbforum.com/downloads.php

YaBB YaBB 1 Gold - SP 1.2

• YaBB 1 Gold - SP 1.3.2
  http://www.yabbforum.com/downloads.php

YaBB YaBB 1 Gold - SP 1.3

• YaBB 1 Gold - SP 1.3.2
  http://www.yabbforum.com/downloads.php

YaBB 1 Gold Multiple Input Validation Vulnerabilities

References:

• [RELEASE] YaBB 1 Gold - SP 1.3.2 (YaBB)
  
• YaBB Homepage (YaBB)