YABB is a popular web-based bulletin board system, written in perl and available from <http://www.yabbforum.com/>. While evaluating it, I found a minor issue where an attacker trying to log in to the forums can extract some useful information making his job easier than it needs to be. Most YABB forums allow 'guest' users to browse postings, but some require users to log in. As this only applies in that latter case, the impact of this vulnerability is low. I have only looked at YABB version 1, SP 1.3.1. In normal user login systems, such as the Unix login, any login failure simply results in a message telling the user that he was unsuccessful, but without saying whether the username was bogus or the password was bogus. When trying to log in to YABB with a bogus username the user is told that the username is incorrect. When trying to log in with a good username but the wrong password, the user is told that the password is incorrect. This means that an attacker has to guess less information. The YABB developers were informed of this on 2004-02-05 via sourceforge and a patch submitted. There has not yet been a response. -- David Cantrell Planckton: n, the smallest possible living thing
