OSVDB ID: 37739

Title: Yahoo! Messenger ActiveX (YVerInfo.dll) Multiple Method Arbitrary Code Execution

Info

Disclosure

Aug 29, 2007

Discovery

Unknown

Dates

Exploit

Unknown

Solution

Aug 29, 2007

Description

A buffer overflow exists in Yahoo Messenger. The YVerInfo.dll ActiveX control fails to validate data passed to the "fvCom()" method resulting in a stack overflow. With a specially crafted website, a context-dependent attacker can cause arbitrary code execution resulting in a loss of integrity.

Classification

Location: Remote / Network Access, Local / Remote, Context Dependent
Attack Type: Input Manipulation
Impact: Loss of Integrity
Solution: Patch / RCS
Exploit: Exploit Public, Exploit Private
Disclosure: Vendor Verified, Vendor Verified, Coordinated Disclosure
OSVDB: Web Related

Solution

Currently, there are no known workarounds or upgrades to correct this issue. However, Yahoo! has released a patch to address this vulnerability.

Products

Yahoo! Inc.

Messenger

8.1

References

Security Tracker: 1018628
CVE ID: 2007-4515 (see also: NVD)
Bugtraq ID: 25494
Secunia Advisory ID: 26579
ISS X-Force ID: 36363
Metasploit ID: 37739
VUPEN Advisory: ADV-2007-3011
Other Advisory URL: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=591
http://securityreason.com/securityalert/3083
Vendor Specific News/Changelog Entry: http://messenger.yahoo.com/security_update.php?id=082907

Credit

Unknown or Incomplete

Direct URL: http://osvdb.org/37739