Yahoo Messenger 8.1 Address Book Buffer Overflow ##################################################################### XDisclose Advisory : XD100002 Vulnerability Discovered : 10 April 2007 Advisory Released : 17 July 2007 Credit : Rajesh Sethumadhavan Class : Buffer OverFlow Denial Of Service Solution Status : Unpatched Vendor : Yahoo Inc Vendor Website : http://www.yahoo.com Affected applications : Yahoo Messenger 8.1 and prior ##################################################################### Overview: Yahoo! Inc. is an American computer services company with a mission to "be the most essential global Internet service for consumers and businesses". It operates an Internet portal, including the popular Yahoo! Mail and Yahoo Messenger. According to Web trends Yahoo! is the most visited website on the Internet today with more than 400 million unique users. The global network of Yahoo! websites received 3.4 billion page views per day on average as of October 2005. Description: Yahoo! Messenger is a widely used communicating program over the Internet. A buffer overflow vulnerability is discovered in the Yahoo! Messenger for Microsoft Windows. Buffer overflow occurs when Yahoo! Messenger loads a specially crafted address book entry. POC: -Create a address book entry using yahoo portal with large amount of 'a' in "email address" textbox. -Login to yahoo messenger -Go to address book tab in yahoo messenger -Place your mouse over the specially crafted address book entry -Yahoo messenger will immediately crash Exploitation Method: -Send an address book to the victim with specially crafted address -Social engineer the victim to place mouse over the imported address Screenshot: http://www.xdisclose.com/images/yahooaddressbof.jpg Impact: Successful exploitation may allows execution of arbitrary code with Privilege of currently log users. Original Advisory: http://www.xdisclose.com/advisory/XD100002.html Credits: Rajesh Sethumadhavan has been credited with the discovery of this vulnerability