Yahoo Messenger Install Secuirty

From: Kyle Duren (acidrain_ask@pixitha.com)
Date: 08/27/02


Date: 27 Aug 2002 06:48:35 -0000
From: Kyle Duren <acidrain_ask@pixitha.com>
To: bugtraq@securityfocus.com


('binary' encoding is not supported, stored as-is)

Im now 100% sure where I should post this or who to tell, but here goes.

I was messing around with just installing some chat programs when I came
across Yahoo Messenger. Well I started the install, and oddly enough its a
lil different. Yahoo decided it would be easier for the user to just
download all the install files from them, on the fly.

The way it does it apperas to be via http:

GET /download.yahoo.com/dl/installs/ymsgr/ymsgr_1228.exe HTTP/1.1

Then the server responds (a19.g.a.yimg.com).

And sends the files.

Well this sounds all fine and dany, except it sounds very familiar to what
the Apple Software Update Util used to do. No passwords or secrity on the
download. The installer never even seems to verify the files.

This leads me to think that someone with enough time and brains could fool
the "victim" computer to download some bogus Yahoo messenger files and
install them instead of the legit ones.

The info on the Apple Security Hole is at:
http://www.cunap.com/~hardingr/projects/osx/exploit.html

Of course this was fixed very quickly by Apple.

Can someone verify this as a valid exploit?

Thanks
Kyle Duren



Relevant Pages

  • Re: Upgrade OS to Tiger
    ... Are the upgrades to the ... I purchased Tiger from the Apple store for around $129 which came as 10.4.6 I think. ... I then ran the OS Software update only with the download only option when a few of the updates were downloaded, I manually ran them and then re-ran Software Update again to get the rest. ... I then downloaded Pacifist and ran it on my original iMac install disks in order to extract and install some of the old bundled packages such as Garageband, Quicken 2004, and Appleworks, etc. ...
    (comp.sys.mac.system)
  • Re: Entourage 2004 constantly crashes
    ... Used Auto-update to download the latest version. ... the menu but if I select it, the finder window shuts and I am back to ... Possibly what happened is that the Apple folks used their migration assistant to move your data onto a fresh install of Mac OS X. ... If you're near an Apple Store or computer store then purchase it there so that you don't have to create your own bootable disk. ...
    (microsoft.public.mac.office.entourage)
  • Re: "None of the checked updates could be installed."
    ... et al. I'm about four updates behind ... message upon install. ... The work around is to download the stand alone ... Macs are Macs and Apple is still making and selling Macs ...
    (comp.sys.mac.system)
  • Re: 10.5.6 is out... and there are problems installing!
    ... and then download and install from the combo updater. ... full download from Apple... ... Macs just work..... ...
    (comp.sys.mac.advocacy)
  • Re: 10.5.6 is out... and there are problems installing!
    ... and then download and install from the combo updater. ... My Mac Pro failed as Snit describes above--update hung, ... I am guessing that Apple has many servers which are sharing the 10.5.6 ...
    (comp.sys.mac.advocacy)