Technology news and Jobs 
Information Technology News Yahoo patches Messenger vulnerabilities
Information Technology News Yahoo patches Messenger vulnerabilities | Yahoo patches Messenger vulnerabilities |
|
| by Stan Beer | |
| Saturday, 09 June 2007 | |
  
Featured Whitepaper
5 Best Practices for Smartphone Support
Yahoo Messenger has an estimated user base of about 100 million and is interoperable with Microsoft Live Messenger. Security firm, eEye Digital Security, which reported the bug to Yahoo on June 5, stated in an advisory: "eEye Digital Security has discovered two critical vulnerabilities in ywcupl.dll (version 2.0.1.4) and ywcvwr.dll (version 2.0.1.4) included by default in all releases of Yahoo! Messenger 8.x. Ywcupl.dll is Yahoo's Webcam Upload ActiveX Control used by Yahoo! Messenger to stream content from a user's webcam to other users. Ywcvwr.dll is Yahoo! Messenger's Webcam Viewer ActiveX Control used to view any streamed content. These files are normally used only when viewing or streaming webcam content to and from Yahoo Messenger, but they are incorrectly marked safe for scripting and can be instantiated by any website. Furthermore they both fail to perform bounds checking on variables resulting in 2 stack-based buffer overflow conditions that could allow arbitrary code to execute in the context of the logged-in user." Yahoo issued a patch for the bug on June 8.{moscomment} |
Tags
| < Next story in category | Previous story in the category > |
|---|
