The vulnerability is located in YMailAttach Active X control, which is provided by ymmapi.dll, according to an advisory released by US-CERT (the United States Computer Emergency Readiness Team).
An attacker can exploit the vulnerability to execute arbitrary code onto an affected PC, causing web browsers to crash. To infect a PC, a malicious user would have to convince a victim - most likely by using social engineering - to view a specially crafted HTML email message or attachment, according to US-CERT.
Yahoo urged users who have a Windows version of Messenger obtained before Nov. 2 to update. No exploit code has been released for the flaw, according to a Yahoo advisory.
Messenger users will be prompted to update every time they sign on, according to the Sunnyvale, Calif. web giant.
US-CERT also issued a workaround for the flaw, advising users to disable ActiveX controls in the Internet Zone.
Click here to email Online Editor Frank Washkuch Jr.
Yahoo Messenger hole patched
By
Frank Washkuch
on
Dec 19, 2006 9:33AM
Yahoo has issued a security update for a flaw in Messenger's ActiveX control.
Got a news tip for our journalists? Share it with us anonymously here.
Partner Content
.png&h=183&w=300&c=1&s=0)
Promoted Content
Accenture and Google Cloud team up to create a loveable, Australian-first, renewable energy product
Promoted Content
How to turn digital complexity into competitive advantage
Promoted Content
Why rethinking your CMS is crucial for customer retention
Promoted Content
Security "mindset shift" needed to protect organisations
Sponsored Whitepapers
Free eBook: Digital Transformation 101 – for banks
Why financial services need to tackle their Middle Office
Learn: The latest way to transfer files between customers
Extracting the value of data using Unified Observability
Planning before the breach: You can’t protect what you can’t see
