Yahoo! Toolbar Helper Class ActiveX Control Remote Buffer Overflow Denial of Service Vulnerability

Bugtraq ID:	26656
Class:	Boundary Condition Error
CVE:	CVE-2007-6228
Remote:	Yes
Local:	No
Published:	Nov 29 2007 12:00AM
Updated:	Jul 14 2008 11:39PM
Credit:	Elazar Broad discovered this vulnerability.
Vulnerable:	Yahoo! Toolbar 1.4.1
Not Vulnerable:

Yahoo! Toolbar Helper Class ActiveX Control Remote Buffer Overflow Denial of Service Vulnerability

Yahoo! Toolbar ActiveX Control is prone to a buffer-overflow vulnerability.

An attacker can exploit this issue to trigger denial-of-service conditions in Internet Explorer or other applications that use the vulnerable ActiveX control. Reports indicate that code execution is not possible, but this has not been confirmed.

Yahoo! Toolbar 1.4.1 is vulnerable to this issue; other versions may also be affected.

Yahoo! Toolbar Helper Class ActiveX Control Remote Buffer Overflow Denial of Service Vulnerability

To exploit these issues, an attacker must entice an unsuspecting user to view a malicious webpage.

The following proofs of concept are available:

• /data/vulnerabilities/exploits/26656.html
• /data/vulnerabilities/exploits/26656-2.html

Yahoo! Toolbar Helper Class ActiveX Control Remote Buffer Overflow Denial of Service Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Yahoo! Toolbar Helper Class ActiveX Control Remote Buffer Overflow Denial of Service Vulnerability

References:

• Microsoft Knowledge Base Article 240797 (Microsoft)
  
• Yahoo! Toolbar Homepage (Yahoo!)