Yahoo! Messenger File Transfer Buffer Overrun Variant Vulnerability

Bugtraq ID:	9383
Class:	Boundary Condition Error
CVE:	CVE-2004-0043
Remote:	Yes
Local:	No
Published:	Jan 08 2004 12:00AM
Updated:	Jul 12 2009 12:56AM
Credit:	Discovery credited to Tri Huynh.
Vulnerable:	Yahoo! Messenger 5.6 .0.1355 Yahoo! Messenger 5.6 .0.1351 Yahoo! Messenger 5.6 .0.1347 Yahoo! Messenger 5.6
Not Vulnerable:	Yahoo! Messenger 5.6 .0.1358 Yahoo! Messenger 5.6 .0.1356 Yahoo! Messenger 5.6 .0.1355

Yahoo! Messenger File Transfer Buffer Overrun Variant Vulnerability

Yahoo! Messenger is vulnerable to a remotely exploitable buffer overrun issue. This vulnerability is due to insufficient bounds checking during user-initiated file transfer requests. A file with a name of excessive length may cause this issue.

Yahoo! Messenger File Transfer Buffer Overrun Variant Vulnerability

The following proof-of-concept has been made available:

"test<insert around 210 spaces here>.jpg

Yahoo! Messenger File Transfer Buffer Overrun Variant Vulnerability

Solution:
Vendor reports relayed through a third party indicate that versions later than 5.6.0 Build 1355 and later are not affected by this issue. The vendor has not directly confirmed this with Symantec.

Yahoo! Messenger File Transfer Buffer Overrun Variant Vulnerability

References:

• Yahoo! Messenger Homepage (Yahoo!)
  
• Yahoo Instant Messenger Long Filename Downloading Buffer Overflow ("Tri Huynh" )