Help Net Security reports that AOL Journals - the company's blogging platform - is suffering from a significant security glitch. HNS reports the issue lies within the blogs' Atom/RSS feed options. A poster named Steve writes...
There is a link on the journals that would allow users to get an Atom or RSS feed for that weblog. The webpage that pops up containing these links to the feeds displays the full path to the user's feed (which includes their username, which is subsequently their e-mail address). The link to the feeds, however, does not use the username in conjunction with the blog name. Instead it uses a BlogID number which appears to just be incremented as blogs are created.As a result an attacker could increment through the numbers and obtain thousands of user e-mail addresses. This flaw is especially noteworthy due to the easy and speed at which an attacker could obtain the usernames. Also, the username and blog names could be easily traversed through to gain information on the user that could be used in conjunction with targeted spam among other things.
According to the report, AOL has yet to patch the hole.
