Feeds

Yahoo! patch squashes messenger bug

Vuln researcher questions company's disclosure practices

Build a business case: developing custom apps

Yahoo! bug crushers have plugged a serious hole in Yahoo! Messenger that made it possible for bad guys to remotely take control of a user's machine. The update became available less than 24 hours after an anonymous hacker posted proof-of-concept code that demonstrated how the vulnerability could be exploited.

The vulnerability stems from a buffer overflow flaw in the messenger's ActiveX control. Attackers could use it to remotely execute malicious code, or for other, less serious things, such forcing a user to log out of a chat or instant messaging session or crash Internet Explorer or another application. To carry out the attack, a miscreant must first prompt the victim to visit a booby-trapped website that contains specially crafted html code.

Ironically, Yahoo!'s own discussion of the flaw may have led to the exploit code, according to Marc Maiffret, a researcher at eEye Digital Security, the security firm that discovered the security hole. An advisory eEye posted on Wednesday warned only that "multiple flaws exist within Yahoo! Messenger which allow for remote execution of arbitrary code with minimal user interaction", eEye refused to say more publicly, out of concern the additional details would enable someone to target the holes.

That didn't stop a Yahoo! spokeswoman from disclosing in a story by Information Week that the security issue was connected to a buffer overflow in Yahoo! Messenger's ActiveX control. She revealed that it was part of the code the program uses to upload and view web cam images.

Shortly thereafter, a person going by the name of Danny posted exploit code here and in the same dispatch included a link to the Information Week article.

A Yahoo! spokeswoman didn't have an immediate comment on the company's vulnerability disclosure practices.

Maiffret, who holds up Microsoft as a model for responsible vulnerability handling, he has no doubt Yahoo! tipped its hands to hackers by giving so many details before a patch was available for download. He says companies responding to security problems should learn from the mistake.

"A lot of these non-Microsoft companies, if you will, are still behind in vulnerability response practices," he says. "This just goes to show it. There's no reason at all for a vendor to list the components." ®

Build a business case: developing custom apps

More from The Register

next story
Kate Bush: Don't make me HAVE CONTACT with your iPHONE
Can't face sea of wobbling fondle implements. What happened to lighters, eh?
The agony and ecstasy of SteamOS: WHERE ARE MY GAMES?
And yes it does need a fat HDD (or SSD, it's cool with either)
Apple takes blade to 13-inch MacBook Pro with Retina display
Shaves price, not screen on mid-2014 model
iPhone 6 flip tip slips in Aussie's clip: Apple's 'reversible USB' leaks
New plug not compatible with official Type-C, according to fresh rumors
Steve Jobs had BETTER BALLS than Atari, says Apple mouse designer
Xerox? Pff, not even in the same league as His Jobsiness
TV transport tech, part 1: From server to sofa at the touch of a button
You won't believe how much goes into today's telly tech
Apple analyst: fruity firm set to shift 75 million iPhones
We'll have some of whatever he's having please
Apple to build WORLD'S BIGGEST iStore in Dubai
It's not the size of your shiny-shiny...
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 10 endpoint backup mistakes
Avoid the ten endpoint backup mistakes to ensure that your critical corporate data is protected and end user productivity is improved.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Rethinking backup and recovery in the modern data center
Combining intelligence, operational analytics, and automation to enable efficient, data-driven IT organizations using the HP ABR approach.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.