Yahoo rushes out IM patch

By Tom Sanders on Jun 12, 2007 12:55 PM
Filed under Software

GLOBAL - Yahoo has released an update for its Instant Messenger software shortly after researchers posted code that exploits flaws in the application.

Security vendor eEye issued an advisory on Tuesday warning about multiple vulnerabilities in Yahoo's messaging software.

The 'critical' vulnerabilities in the ActiveX component that controls webcams could allow an attacker to take control of a system by luring users to a specially crafted website or email message.

Researchers took less than 24 hours to create the exploit code after eEye published its advisory. The exploit has since been widely distributed through well known security sources including the Full Disclosure security mailing list.

Yahoo has urged users of the "All New Yahoo Messenger" to update to the latest version of the software. The application will prompt users of the available update when they sign-on.