[NT] Yahoo Instant Messenger YAUTO.DLL Buffer Overflow (YAuto.NSAuto.1)

From: SecuriTeam (support_at_securiteam.com)
Date: 12/03/03

  • Next message: SecuriTeam: "[NT] IBM Directory Server Web Admin GUI (ldacgi.exe) XSS Vulnerability" 
    To: list@securiteam.com
Date: 3 Dec 2003 15:37:37 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      Yahoo Instant Messenger YAUTO.DLL Buffer Overflow (YAuto.NSAuto.1)
    ------------------------------------------------------------------------

    SUMMARY

    YIM (Yahoo Instant Messenger) is one of the most popular instant
    messengers. A vulnerability within one of the DLLs provided by the product
    allows a remote attacker to create a page that will execute arbitrary code
    on the user's remote computer once he visits it.

    DETAILS

    Vulnerable systems:
     * Yahoo Instant Messenger version 5.6.0.1347 and prior

    YAUTO.DLL is an ActiveX/COM component that comes with Yahoo Install
    Messenger. YAUTO.DLL is registered under a ProgID called "YAuto.NSAuto.1".
    In this component, there is a function named Open(String URL) that will
    cause a buffer overflow if argument URL is passed with a long string.
    Since this is an ActiveX component, the vulnerability can be exploited
    just by making a website with the correct CLSID of the ActiveX and call
    the function directly. NOTE: this object has not been marked "SAFE" for
    scripting, therefore a warning will pop-up prior to the object being
    created (exploited).

    Workaround:
    A workaround solution is deleting the YAUTO.DLL file in your YIM
    directory.

    Vendor status:
    Yahoo has been contacted at enterprisesales@yahoo-inc.com but doesn't
    response for a month.

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:trihuynh@zeeup.com> Tri
    Huynh.

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[NT] IBM Directory Server Web Admin GUI (ldacgi.exe) XSS Vulnerability"

    Relevant Pages

    • [NT] Yahoo Messenger YMailAttach ActiveX Control Heap Corruption Vulnerability
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Yahoo Messenger YMailAttach ActiveX Control Heap Corruption Vulnerability ... Yahoo Instant Messenger version 8.0 ...
      (Securiteam)
    • [NT] LANDesk Management Suite IRCRBOOT.DLL Buffer Overflow
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... LANDeskŪ Management Suite enables IT professionals to automate ... A vulnerability in one of the product's DLL allows attackers via an ... IRCRBOOT.DLL is an ActiveX/COM component that comes with LANDesk ...
      (Securiteam)
    • [UNIX] Trend Micro VirusWall Buffer Overflow in VSAPI Library
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... buffer overflow vulnerability in VSAPI library allows arbitrary code ... is called "vscan" which is set suid root by default. ... permissions and thus granted all local users the privilege to execute the ...
      (Securiteam)
    • [UNIX] SCO Multiple Local Buffer Overflow
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Local exploitation of a buffer overflow vulnerability in the ppp binary, ... allows attackers to gain root privileges. ...
      (Securiteam)
    • [NT] Microsoft Word 6.0/95 Document Converter Buffer Overflow (MS04-041)
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... WordPad is "a word processing application that uses the MFC rich edit ... Remote exploitation of a buffer overflow vulnerability in Microsoft ... Microsoft Word format files into the Rich Text Format natively handled by ...
      (Securiteam)