Yahoo updates to patch Messenger ActiveX vulnerability

By

Yahoo has updated its instant messaging platform to protect against a vulnerability that can allow remote attacks.

Yahoo updates to patch Messenger ActiveX vulnerability
Versions of Yahoo Messenger installed before 13 March contain a flaw that can allow remote code attacks, Yahoo said Monday in an security advisory.

The flaw is caused by a boundary error within the AudioConf ActiveX control (yacscom.dll), according to an advisory from Secunia.

The vulnerability can be exploited to cause a stack-based buffer overflow by setting the "socksHostname" and "hostname" properties to an overly large strong and then calling the "createAndJoinConference()" method, according to Secunia’s advisory.

The flaw exists in Yahoo Messenger versions 5, 6, 7 and 8, according to Secunia.

An advisory from TippingPoint’s Zero Day Initiative, which first disclosed the flaw to Yahoo last October, reported that user interaction is required to exploit the flaw, most commonly through a duped user visiting a malicious website.

Secunia today ranked the flaw as "highly critical," meaning that it can be exploited by arbitrary code.
Got a news tip for our journalists? Share it with us anonymously here.
Tags:

Most Read Articles

First npm worm "Shai-Hulud" released in supply chain attack

First npm worm "Shai-Hulud" released in supply chain attack

"VoidProxy" PhishKit targets Google and Microsoft users

"VoidProxy" PhishKit targets Google and Microsoft users

Actor auth tokens gave Global Admin access across Azure Entra ID tenants

Actor auth tokens gave Global Admin access across Azure Entra ID tenants

NSW gov third party-linked cyber incidents quadruple in two years

NSW gov third party-linked cyber incidents quadruple in two years

Log In

  |  Forgot your password?