Yahoo Exploit in the Wild

[Symantec]

Yahoo Exploit in the Wild
<p>A couple of extremely critical vulnerabilities were discovered and disclosed in Yahoo! Messenger two days ago, on June 6th. Late last night and early this morning, exploits were released to take advantage of these issues. At the time of the release, Yahoo had not yet patched the issues, so Yahoo! Messenger users were at significant risk of being attacked.</p>

<p>The two vulnerabilities are both buffer overflows in the ActiveX control that handles Yahoo’s Webcam functionality [1][2]. Due to the exploits being released publicly, anyone can carry out an attack by persuading a user into following a link to a malicious file.</p>

<p>Fortunately, Yahoo has released an update to their Yahoo! Messenger product to resolve this issue. The latest version of the software, version 8.1, is reportedly not vulnerable. Users should update as soon as possible to reduce their exposure to potential attacks.</p>

<p>[1] <a href="http://www.securityfocus.com/bid/24355">http://www.securityfocus.com/bid/24355</a><br />
[2] <a href="http://www.securityfocus.com/bid/24354">http://www.securityfocus.com/bid/24354</a><br />
</p>
http://www.symantec.com/enterprise/security_response/weblog/2007/06/yahoo_exploit_in_the_wild.html
http://www.symantec.com/enterprise/security_response/weblog/2007/06/yahoo_exploit_in_the_wild.html
Fri, 08 Jun 2007 13:40:44 -0800