Signature Detail
Short Name |
HTTP:STC:ACTIVEX:YAHOO-AUDIO |
|---|---|
Severity |
High |
Recommended |
No |
Recommended Action |
Drop |
Category |
HTTP |
Keywords |
Yahoo Messenger AudioConf ActiveX Control Buffer Overflow |
Release Date |
2007/04/11 |
Update Number |
1213 |
Supported Platforms |
idp-4.0+, isg-3.0+, j-series-9.5+, mx-9.4+, srx-9.2+, srx-branch-9.4+, vsrx-12.1+ |
HTTP: Yahoo Messenger AudioConf ActiveX Control Buffer Overflow
This signature detects attempts to exploit a known vulnerability in Yahoo Messenger. Attackers can create Web pages containing dangerous ActiveX calls, which if accessed by a victim, allows the attacker to gain control of the victim's system.
Extended Description
The Audio Conferencing ActiveX control shipped with Yahoo! Messenger is prone to a buffer-overflow vulnerability. The software fails to perform sufficient bounds-checking of user-supplied input before copying it to an insufficiently sized memory buffer. Yahoo! Messenger versions released prior to March 13, 2007 are vulnerable to this issue.
Affected Products
- Yahoo! Messenger 8.0.0
- Yahoo! Messenger 8.0.0.863
- Yahoo! Messenger 8.0 2005.1.1.4
- Yahoo! Messenger 8.1.0.209
- Yahoo! Messenger 8.1.0.239
References