Yahoo! Assistant 'yNotifier.dll' ActiveX Control Memory Corruption Vulnerability

Bugtraq ID:	29065
Class:	Unknown
CVE:	CVE-2008-2111
Remote:	Yes
Local:	No
Published:	May 06 2008 12:00AM
Updated:	Apr 16 2015 06:01PM
Credit:	Sowhat
Vulnerable:	Yahoo! Assistant 3.6
Not Vulnerable:

Yahoo! Assistant 'yNotifier.dll' ActiveX Control Memory Corruption Vulnerability

Yahoo! Assistant 'yNotifier.dll' ActiveX control is prone to a memory-corruption vulnerability.

Successfully exploiting this issue may allow remote attackers to execute arbitrary code in the context of the application using the affected ActiveX control. Failed exploit attempts will likely crash the application.

The issue affects Yahoo! Assistant 3.6 and prior versions.

Yahoo! Assistant 'yNotifier.dll' ActiveX Control Memory Corruption Vulnerability

An attacker can exploit this issue by enticing an unsuspecting victim to view a malicious HTML page.

The following HTML proof of concept is available:

<object classid='clsid:2283BB66-A15D-4AC8-BA72-9C8C9F5A1691'>

Yahoo! Assistant 'yNotifier.dll' ActiveX Control Memory Corruption Vulnerability

Solution:
Reportedly, the vendor has patched this issue. Please contact the vendor for details.

Yahoo! Assistant 'yNotifier.dll' ActiveX Control Memory Corruption Vulnerability

References:

• Yahoo! Assistant Homepage (Yahoo!)
  
• Yahoo! Assistant (3721) ActiveX Remote Code Execution Vulnerability (Sowhat)