Webcam settings could allow arbitrary code to be run
vnunet.com, 07 Jun 2007
Two 'extremely critical' vulnerabilities have been discovered in Yahoo Messenger that could be exploited by malicious users to compromise a system.
The boundary errors have been confirmed in version 8.1.0.249 of the messaging software, but other versions may also be affected.
Both flaws are based around the Yahoo Webcam facilities within the software. The problems occur in the 'ywcupl.dll' file that deals with the Webcam Upload, and the 'ywcvwr.dll' file which handles the Webcam Viewer.
Both ActiveX controls can be exploited to cause a stack-based buffer overflow by assigning an overly long string to the Server property and then using the 'Send()' or 'Receive()' actions.
A successful execution of the exploits could allow arbitrary code to be run on the affected machine.
Security firm Secunia rated the flaws at its highest 'extremely critical' level, and said that the problems can be blocked by changing the kill-bit settings for the affected ActiveX controls.
Secunia advisory 25547: Yahoo Messenger Two ActiveX Controls Buffer Overflows
Security suite overcomes February failure to earn VB100 certification
Java flaws affect Mac and Windows versions
But the good news is that the number of insecure firms has fallen
In part one of V3.co.uk's interview with Dirk Singer, he dicusses social media monitoring strategies
Remote access - Three steps to getting connected
3.4 million UK professionals now work from home – is your company equipped?
Cost benefits of a global collaboration network
This white paper is a must read for organisations looking for evidence of the bottom-line benefits of high-definition video and voice communications
Keep up to date with the latest products, services and technologies from the world's leading IT companies; IThound.com brings you over 6,000 white papers, case studies and analyst reports.
Join our live chat session on Thursday at 11am to...
Researchers from security firm FireEye have been able to effectively...
Do you agree?
Have your say on this article