Trillian 3 Vulnerability

[iago]

Hi Everyone,

I was playing around with Trillian Pro 3.1 Build 121 and noticed a very disturbing behavior when using it to check my yahoo mail.

When you choose the option to check your yahoo email from Trillian (The little connection ball -> Check Yahoo Mail) it creates a temp file in the <Install Directory>\users\default\cache with a random name that contains the yahoo password in *clear text* and this file is world readable. This would be somewhat ok if the file was deleted as soon as the login was done but the file just sits there till you exit out of trillian. Logging out doesn't erase the file. I have watched the file exist on my system for over two weeks.

Now I shouldn't have to tell you why having a file like this will a password in clear text is such a bad idea. All anyone needs is 2 mins unsupervised on a computer that uses trillian and they will have the user's password and since a lot of people use the same password for various sites this will compromise a lot of other accounts too.

In my opinion the file shouldn't contain the password in the first place but even if it *has* to have the password it should be deleted as soon as the login is done and not sit there for over two weeks.

I have duplicated this with Trillian 3.0 Basic and Pro also. Tested on Windows XP Pro and Windows 2000.

I have attempted to contact Cerulean Studios multiple times before releasing this using their webform, email and forums over the past month but havn't heard anything back from them. My last attempt to contact them was on 06/13/2005. Since I havn't heard anything from them I am sending this to Bugtraq.

If you have any questions/comments about this let me know.

Thanks,
 Suramya

--
----------------------------------------------------------
Mountain Dew and doughnuts... because breakfast is the
most important meal of the day
----------------------------------------------------------
Name : Suramya Tomar
Homepage URL: http://www.suramya.com
-------------------------------------------------

************************************************************
Disclaimer:
Any errors in spelling, tact, or fact are transmission errors.
************************************************************

[Quik]

I saw this yesterday but could not replicate it.

[iago]

I saw this yesterday but could not replicate it.

Did you follow the instructions?

When you choose the option to check your yahoo email from Trillian (The little connection ball -> Check Yahoo Mail) it creates a temp file in the <Install Directory>\users\default\cache with a random name that contains the yahoo password in *clear text* and this file is world readable.

The key that a lot of people miss is that you have to check your Yahoo mail. 

[Quik]

I use the program to check my own mail. I have not been able to find a file that contains text.