Yahoo! Messenger YAuto.DLL Open Buffer Overflow Vulnerability

Bugtraq ID:	9145
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 03 2003 12:00AM
Updated:	Dec 03 2003 12:00AM
Credit:	Discovery credited to Tri Huynh.
Vulnerable:	Yahoo! Messenger 5.6 .0.1347 Yahoo! Messenger 5.6
Not Vulnerable:

Yahoo! Messenger YAuto.DLL Open Buffer Overflow Vulnerability

A problem has been identified in the handling of some types of requests by ActiveX controls installed with Yahoo! Messenger, exposing a remotely exploitable buffer overrun. Because of this, it may be possible for an attacker to execute arbitrary code on a vulnerable host.

Yahoo! Messenger YAuto.DLL Open Buffer Overflow Vulnerability

The researcher who discovered this vulnerability has developed a functioning exploit which is not publicly available or known to be circulating in the wild.

Yahoo! Messenger YAuto.DLL Open Buffer Overflow Vulnerability

Solution:
The vendor has released an update to address this issue:


Yahoo! Messenger 5.6

• Yahoo! update4
  http://messenger.yahoo.com/security/update4.html

Yahoo! Messenger 5.6 .0.1347

• Yahoo! update4
  http://messenger.yahoo.com/security/update4.html

Yahoo! Messenger YAuto.DLL Open Buffer Overflow Vulnerability

References:

• Yahoo! Messenger Homepage (Yahoo!)
  
• Yahoo Instant Messenger YAUTO.DLL buffer overflow ("Tri Huynh" )