Results 1 to 4 of 4

Thread: Yahoo! Store Security

  1. #1
    Senior Member PacketThirst's Avatar
    Join Date
    Aug 2004

    Yahoo! Store Security

    I got the following from


    Yahoo! Store Security Advisory

    Advisory: http://securitytracker.com/id?1011403
    Date: September 23, 2004
    Vendor: Yahoo!
    Product: Yahoo! Store
    Status: Fixed by the vendor; Coordinated release
    Credit: Ben Efros
    benjamin AT pcguy DOT org


    Ben Efros reported the following vulnerability in the Yahoo! Store
    shopping cart to SecurityTracker <bugs AT securitytracker DOT com> on August
    15, 2004.

    A remote user can effectively alter the price of merchandise being
    placed into their shopping cart.

    A remote user can submit modified HTML to the affected commerce site
    with an unauthorized item option or with a valid option that has been
    price-modified. The system will compute the order using the price of
    the option, which can be a positive or negative value. If the merchant
    does not review the order prior to fulfillment, the item may be sold for
    the incorrect price.

    The 'options' select item lists are intended to be used to define
    separately priced purchasing options, such as additional accessories,
    different sizes, extended warranties, and express shipping.

    An example of a select item option is provided:

    <SELECT NAME="Express Shipping">
    <OPTION>Yes (+8.95)</OPTION>

    A remote user can modify the price of the select item option to an
    arbitrary value, even to a negative number. If an item is purchased
    with a negative price option selected, then the price of the order will
    be reduced by the negative amount selected.

    If a merchant does not use options, a remote user can still add an
    arbitrary option with an arbitrary price.

    Notification Timeline:

    August 15, 2004 - Vendor notification
    September 8, 2004 - Vendor fix
    September 8, 2004 - Merchant notification
    September 23, 2004 - Public advisory

    Solution: The vendor issued a production fix on September 8, 2004. The
    fix adds an "Item Options Validation" setting for merchants so that
    merchants can automatically reject unrecognized options. The default
    configuration for existing merchants is to reject unrecognized options.

    The vendor has described the new option at:


    SecurityTracker thanks Ben Efros for reporting this flaw and Yahoo! for
    their response and remediation efforts.

    This advisory is copyright 2004 by SecurityTracker (SecurityGlobal.net
    LLC). Permission is granted to redistribute this advisory in electronic
    form in its entirety and without modification.

    bugs AT securitytracker DOT com

    So much for secure shopping !

    PacKet Thirst

  2. #2
    AO Ancient: Team Leader
    Join Date
    Oct 2002
    You might want to either read the whole thing or understand what it is you are reading. Firstly this is about a week old... Use Securityfocus for your bugtraq feed, it's obvously quicker...


    August 15, 2004 - Vendor notification
    September 8, 2004 - Vendor fix
    September 8, 2004 - Merchant notification
    September 23, 2004 - Public advisory
    The second line means it's fixed, the third line means the merchants have been instructed to make any alterations required. Note the date of the public advisory. So this is a done deal.

    Lastly, there is no risk to your shopping. It's a risk to the merchant because I could change the price of that shiney new laptop from $1500 to $15. No threat to you personally.
    Don\'t SYN us.... We\'ll SYN you.....
    \"A nation that draws too broad a difference between its scholars and its warriors will have its thinking done by cowards, and its fighting done by fools.\" - Thucydides

  3. #3
    the beign of authority kurt_der_koenig's Avatar
    Join Date
    Jan 2004
    A remote user can submit modified HTML...
    Dude...thats been around for a long time but one would think yahoo would know better...ah oh well. Free stuff for me lol jk

  4. #4
    Yahoo Has fixed, and it is not an big problem.

    It is enough secure, coz u get the shooping cart as well as a secured payment processing.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts