Blogs at Free Downloads Center

‘Extremely critical’ flaws hit Yahoo Messenger

Tilgore Kraut - June 7, 2007

web_msg_pic_1.jpgTwo ‘extremely critical’ vulnerabilities have been discovered in Yahoo Messenger that could be exploited by malicious users to compromise a system.

The boundary errors have been confirmed in version 8.1.0.249 of the messaging software, but other versions may also be affected.

Both flaws are based around the Yahoo Webcam facilities within the software. The problems occur in the ‘ywcupl.dll’ file that deals with the Webcam Upload, and the ‘ywcvwr.dll’ file which handles the Webcam Viewer.

Both ActiveX controls can be exploited to cause a stack-based buffer overflow by assigning an overly long string to the Server property and then using the ‘Send()’ or ‘Receive()’ actions.

A successful execution of the exploits could allow arbitrary code to be run on the affected machine.

Security firm Secunia rated the flaws at its highest ‘extremely critical’ level, and said that the problems can be blocked by changing the kill-bit settings for the affected ActiveX controls.

Secunia advisory 25547: Yahoo Messenger Two ActiveX Controls Buffer Overflows

(via vnunet.com)

This entry was posted on Thursday, June 7th, 2007 at 8:34 am and is filed under Developer, Freeware, Information Management, Internet, Radio, SMS, Social Software, Themes, Windows. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.

Rating

1 Star2 Stars3 Stars4 Stars5 Stars (3 votes, average: 4.33 out of 5)
Loading...

2 Responses to “‘Extremely critical’ flaws hit Yahoo Messenger”

  1. kapil Says:

    it was hacked

  2. DLL Files Dude Says:

    Thats interesting. I’ve not heard this news yet ywcvwr.dll exploit?

Leave a Reply

Copyright © 2001-2020, Free Downloads Center. Free Downloads Center Blog is proudly powered by WordPress.