Short Name |
CHAT:YIM:DOUBLE-EXT |
---|---|
Severity |
Minor |
Recommended |
No |
Category |
CHAT |
Keywords |
Yahoo! Messenger File Transfer Filename Spoofing |
Release Date |
2008/01/17 |
Update Number |
1213 |
Supported Platforms |
idp-4.0+, isg-3.0+, j-series-9.5+, mx-11.4+, srx-12.1+, srx-branch-12.1+, vmx-17.4+, vsrx-12.1+, vsrx3bsd-18.2+ |
This signature detects attempts to exploit a known vulnerability in Yahoo Instant Messenger's file transfer method. An attacker can submit a file with a double file extension. This could fool users into downloading malicious content without their knowledge.
A remote download dialogue box spoofing vulnerability affects Yahoo! Messenger. This issue is due to a design error that facilitates the spoofing of file names. An attacker may leverage this issue to spoof downloaded file names to unsuspecting users. This issue may lead to a compromise of the target computer as well as other consequences. It should be noted that although only Yahoo! Messenger version 6.0.0.1750 is reportedly affected; earlier versions may be affected as well.