[NT] Yahoo Instant Messenger YAUTO.DLL Buffer Overflow (YAuto.NSAuto.1)

• Previous message: SecuriTeam: "[UNIX] RNN's Guestbook Multiple Vulnerabilities"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

To: list@securiteam.com
Date: 3 Dec 2003 15:37:37 +0200

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -

  Yahoo Instant Messenger YAUTO.DLL Buffer Overflow (YAuto.NSAuto.1)
------------------------------------------------------------------------

SUMMARY

YIM (Yahoo Instant Messenger) is one of the most popular instant
messengers. A vulnerability within one of the DLLs provided by the product
allows a remote attacker to create a page that will execute arbitrary code
on the user's remote computer once he visits it.

DETAILS

Vulnerable systems:
 * Yahoo Instant Messenger version 5.6.0.1347 and prior

YAUTO.DLL is an ActiveX/COM component that comes with Yahoo Install
Messenger. YAUTO.DLL is registered under a ProgID called "YAuto.NSAuto.1".
In this component, there is a function named Open(String URL) that will
cause a buffer overflow if argument URL is passed with a long string.
Since this is an ActiveX component, the vulnerability can be exploited
just by making a website with the correct CLSID of the ActiveX and call
the function directly. NOTE: this object has not been marked "SAFE" for
scripting, therefore a warning will pop-up prior to the object being
created (exploited).

Workaround:
A workaround solution is deleting the YAUTO.DLL file in your YIM
directory.

Vendor status:
Yahoo has been contacted at enterprisesales@yahoo-inc.com but doesn't
response for a month.

ADDITIONAL INFORMATION

The information has been provided by <mailto:trihuynh@zeeup.com> Tri
Huynh.

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

• Previous message: SecuriTeam: "[UNIX] RNN's Guestbook Multiple Vulnerabilities"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

Relevant Pages

• [NT] Yahoo Messenger YMailAttach ActiveX Control Heap Corruption Vulnerability
  ... The following security advisory is sent to the securiteam mailing list, and can be
  found at the SecuriTeam web site: http://www.securiteam.com ... Yahoo Messenger YMailAttach
  ActiveX Control Heap Corruption Vulnerability ... Yahoo Instant Messenger version 8.0
  ... (Securiteam)
• [NT] LANDesk Management Suite IRCRBOOT.DLL Buffer Overflow
  ... The following security advisory is sent to the securiteam mailing list, and can be
  found at the SecuriTeam web site: http://www.securiteam.com ... LANDeskŪ Management Suite enables
  IT professionals to automate ... A vulnerability in one of the product's DLL allows attackers
  via an ... IRCRBOOT.DLL is an ActiveX/COM component that comes with LANDesk ...
  (Securiteam)
• [UNIX] Trend Micro VirusWall Buffer Overflow in VSAPI Library
  ... The following security advisory is sent to the securiteam mailing list, and can be
  found at the SecuriTeam web site: http://www.securiteam.com ... buffer overflow vulnerability
  in VSAPI library allows arbitrary code ... is called "vscan" which is set suid root by
  default. ... permissions and thus granted all local users the privilege to execute the
  ... (Securiteam)
• [UNIX] SCO Multiple Local Buffer Overflow
  ... The following security advisory is sent to the securiteam mailing list, and can be
  found at the SecuriTeam web site: http://www.securiteam.com ... Local exploitation of a buffer
  overflow vulnerability in the ppp binary, ... allows attackers to gain root privileges.
  ... (Securiteam)
• [NT] Microsoft Word 6.0/95 Document Converter Buffer Overflow (MS04-041)
  ... The following security advisory is sent to the securiteam mailing list, and can be
  found at the SecuriTeam web site: http://www.securiteam.com ... WordPad is "a word processing
  application that uses the MFC rich edit ... Remote exploitation of a buffer overflow vulnerability
  in Microsoft ... Microsoft Word format files into the Rich Text Format natively handled
  by ... (Securiteam)