Yahoo! Voice Chat ActiveX Control Buffer Overflow Vulnerability
BID:7561
Info
Yahoo! Voice Chat ActiveX Control Buffer Overflow Vulnerability
| Bugtraq ID: | 7561 |
| Class: | Boundary Condition Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | May 12 2003 12:00AM |
| Updated: | May 12 2003 12:00AM |
| Credit: | The discovery of this vulnerability has been credited to Cesar <[email protected]>. |
| Vulnerable: |
Yahoo! Audio Conferencing ActiveX Control 1.0 .0.43 |
| Not Vulnerable: |
Yahoo! Audio Conferencing ActiveX Control 1.0 .0.45 |
Discussion
Yahoo! Voice Chat ActiveX Control Buffer Overflow Vulnerability
It has been reported that the ActiveX control used by the Yahoo! Voice Chat feature is prone to an exploitable buffer overflow vulnerability. This issue can be exploited via a malicious web page that calls the vulnerable control with malformed parameters. Although unconfirmed, it has been conjectured that this condition may be exploited to execute arbitrary code.
It has been reported that the ActiveX control used by the Yahoo! Voice Chat feature is prone to an exploitable buffer overflow vulnerability. This issue can be exploited via a malicious web page that calls the vulnerable control with malformed parameters. Although unconfirmed, it has been conjectured that this condition may be exploited to execute arbitrary code.
Exploit / POC
Yahoo! Voice Chat ActiveX Control Buffer Overflow Vulnerability
The following proof-of-concept was submitted:
------sample.htm-----------
<OBJECT id=yahooaudio type="application/x-oleobject"
classid="clsid:2B323CD9-50E3-11D3-9466-00A0C9700498">
</OBJECT>
<script>
yahooaudio.hostname="longstringheremorethan500chars";
yahooaudio.createandjoinconference();
</script>
---------------------------
The following proof-of-concept was submitted:
------sample.htm-----------
<OBJECT id=yahooaudio type="application/x-oleobject"
classid="clsid:2B323CD9-50E3-11D3-9466-00A0C9700498">
</OBJECT>
<script>
yahooaudio.hostname="longstringheremorethan500chars";
yahooaudio.createandjoinconference();
</script>
---------------------------
Solution / Fix
Yahoo! Voice Chat ActiveX Control Buffer Overflow Vulnerability
Solution:
The vendor has addressed this issue. The The CLSID of the control is 2B323CD9-50E3-11D3-9466-00A0C9700498 and this issue is corrected in version 1.0.0.45. Users may obtain upgrade instructions at the following location:
http://messenger.yahoo.com/messenger/security
Solution:
The vendor has addressed this issue. The The CLSID of the control is 2B323CD9-50E3-11D3-9466-00A0C9700498 and this issue is corrected in version 1.0.0.45. Users may obtain upgrade instructions at the following location:
http://messenger.yahoo.com/messenger/security
References
Yahoo! Voice Chat ActiveX Control Buffer Overflow Vulnerability
References:
References:
- Yahoo! Audio Conferencing Update (Yahoo!)
- Yahoo! Chat (Yahoo!)
- Yahoo! Security Advisory: Yahoo! Voice Chat (Yahoo!Security Contact