Remote code execution bug in Yahoo servers leads to root access
Another now-closed bug in Yahoo's servers have revealed that it was running an old server kernel allowing root access to its system, according to security researcher Ebrahim Hegazy.
Hegazy found that by manipulating one of the parameters in the URLs used in Yahoo Mail, he could cause the server to execute system commands remotely.
On Yahoo's end, the parameter is used within a php eval() function, which takes a strings (the parameter Hegazy manipulated) and executes it as php code. The documentation for the php function explicitly warns against its use where possible, and where there is no other option, that the string passed to eval() is validated carefully. This validation process appears not to have happened, with Hegazy able to use a combination of print() and system() functions to execute commands and return the results.
