[Full-disclosure] Kaspersky Lab Online Activation Center remote brute force vulnerability

[www417 <www417@xxxxxxxxx>]

Dear all:

I found vulnerability in Kaspersky Lab Online Activation center (
https://activation.kaspersky.com).
The threat will help a remote attacker to brute force activation code
and sale to victim.

Remote attackers only need a script (Perl or Python or Windows Batch) and a
GUN program (wget or curl).
Although the number of activation code is so huge that brute force, but I
still have idea for make it easy.
Successfully exploitation the threat, remote attackers have ability to
online steal lots activation codes.

I have posted a POC for showing the thread, you can download from
http://www417.googlepages.com/kaspersky.zip
I also added a file, named "Readme.txt" for detail how to use the tool.
Please scan the tools by your Anti-Virus, and then test them on safely
machine.

* I also had sent the detail of the vulnerability to Kaspersky, but looks
like they did not interest. :(



Thanks and Regards
www417

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/