Signature Detail
Short Name |
HTTP:STC:ACTIVEX:YAHO-YNOTIFIER |
|---|---|
Severity |
High |
Recommended |
No |
Recommended Action |
Drop |
Category |
HTTP |
Keywords |
Yahoo Assistant Unsafe ActiveX Control |
Release Date |
2012/12/04 |
Update Number |
2208 |
Supported Platforms |
idp-4.0.110090709+, isg-3.1.134269+, j-series-9.5+, mx-9.4+, srx-9.2+, srx-branch-9.4+, vsrx-12.1+ |
HTTP: Yahoo Assistant Unsafe ActiveX Control
This signature detects attempts to use unsafe ActiveX controls in Yahoo Assistant. An attacker can create a malicious Web site containing Web pages with dangerous ActiveX controls, which if accessed by a victim, allows the attacker to gain control of the victim's client browser, resulting in a user-level arbitrary code execution.
Extended Description
Yahoo! Assistant 'yNotifier.dll' ActiveX control is prone to a memory-corruption vulnerability. Successfully exploiting this issue may allow remote attackers to execute arbitrary code in the context of the application using the affected ActiveX control. Failed exploit attempts will likely crash the application. The issue affects Yahoo! Assistant 3.6 and prior versions.
Affected Products
- Yahoo! Assistant 3.6
References
- BugTraq: 29065
- CVE: CVE-2008-2111