valueclick-cgi.txt

`Date: Sat, 19 Dec 1998 17:19:34 +0200  
From: Philip Stoev <[email protected]>  
Reply-To: Bugtraq List <[email protected]>  
To: [email protected]  
Subject: ValueClick CGI Vulnerability  
  
[ The following text is in the "KOI8-R" character set. ]  
[ Your display is set for the "US-ASCII" character set. ]  
[ Some characters may be displayed incorrectly. ]  
  
The ValueClick Online Advertising agency web interface has a CGI  
vulnerability that allows easy username/password capture without using  
sniffing software.  
  
When you go to ValueClick home page (www.valueclick.com) and log on, your  
username and password are embedded in the URL and if you subsequently leave  
their site and go somewhere else, this URL will end up in this site's HTTP  
refferer log which I beleive is a serious fault because one can easily not  
just garble with your account, but also redirect any cheques you are about  
to receive from ValueClick to himself.  
  
ValueClick was notified several months ago and they responded they will  
substitute GET with POST in their CGI, but they have taken no such action.  
  
Sincerely,  
  
Philip Stoev  
  
-- Free SAT & TOEFL preparation softwate @ http://studywiz.hypermart.net  
This message was sent by Philip Stoev ([email protected])  
tel: (359 2) 715949, 9549488 fax: (359 2) 544669  
  
-------------------------------------------------------------------------  
  
Date: Sat, 19 Dec 1998 19:57:20 -0500  
From: "Ellen (ValueClick)" <[email protected]>  
Reply-To: Bugtraq List <[email protected]>  
To: [email protected]  
Subject: ValueClick  
  
Hi,  
  
Please allow me to introduce myself. My name is Ellen O'Rourke and I am  
Host Member Manager for ValueClick.  
  
I would like to refer to the letter you wrote [email protected]  
regarding "ValueClcik vernerability."  
  
Let me explain:  
  
If the user decides to go to another site after they  
are logged in, either via a bookmark or typing in  
a url, the referring url will be blank. If we had  
a link to the outside, the referring url would  
contain the logged in user's username and password.  
  
The links that we do have to the outside, such  
as on the exclude banners page where a user  
can click on a banner to view the advertiser's  
site, have the referring url stripped off to  
protect the host's login info.  
  
If you have evidence that contradicts this, we would very much appreciate  
your advising us.  
  
We appreciate your interest in ValueClick.  
  
---------------------------------------------------------  
Ellen O'Rourke  
Member Site Manager [email protected]  
ValueClick  
The pay-for-results advertising network!  
  
ValueClick Banner Ad Network http://www.valueclick.com  
  
  
---------------------------------------------------------  
  
-------------------------------------------------------------------------  
  
Date: Sat, 19 Dec 1998 18:47:56 -0800  
From: Trev <[email protected]>  
Reply-To: Bugtraq List <[email protected]>  
To: [email protected]  
Subject: Re: ValueClick  
  
Hi Ellen  
  
Perhaps you haven't heard of the Brumleve cache bug, or the other various  
ways remote websites can gather the information in your browser's history.  
It is so simple to use POST instead of GET... I don't see why you want to  
take the chance of it being intercepted. There are a number of ways that  
requested URLs can be logged etc.  
  
Trev  
  
`