Yahoo! Messenger YVerInfo.dll ActiveX control buffer overflow
| yahoo-messenger-yverinfo-bo (36363) |  High Risk |
Description:
The Yahoo! Messenger ActiveX control (YVerInfo.dll) is vulnerable to a stack-based buffer overflow. By persuading a victim to visit a specially-crafted Web site, a remote attacker could overflow a buffer and execute arbitrary code on the system with the privileges of the victim or cause the application to crash.
Platforms Affected:
- Yahoo, Messenger 8.1.0.413
Remedy:
Upgrade to the latest version of Yahoo! Messenger (8.1.0.419 or later), available from the Yahoo Messenger Web site - Security Updates. See References.
Consequences:
Gain Access
References:
- iDefense Labs PUBLIC ADVISORY: 08.30.07, Yahoo Messenger YVerInfo.dll ActiveX Multiple Remote Buffer Overflow Vulnerabilities at http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=591.
- Yahoo Messenger Web site - Security Updates, Yahoo! ActiveX Control Update - buffer overflow in an ActiveX control at http://messenger.yahoo.com/security_update.php?id=082907.
- BID-25494: Yahoo! Messenger YVerInfo.DLL ActiveX Control Multiple Buffer Overflow Weaknesses
- CVE-2007-4515: Buffer overflow in a certain ActiveX control in YVerInfo.dll before 2007.8.27.1 in the Yahoo! services suite for Yahoo! Messenger before 8.1.0.419 allows remote attackers to execute arbitrary code via unspecified vectors involving arguments to the (1) fvCom and (2) info methods. NOTE: some of these details are obtained from third party information.
- SA26579: Yahoo! Messenger YVerInfo.dll ActiveX Control Buffer Overflows
- SECTRACK ID: 1018628: Yahoo! Messenger Buffer Overflow in ActiveX Control Lets Remote Users Execute Arbitrary Code
- VUPEN/ADV-2007-3011: Yahoo! Messenger Get Version Info ActiveX Remote Code Execution Vulnerability
Reported:
Aug 29, 2007
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net