Description
The installer in Yahoo! Messenger 4.0, 5.0 and 5.5 does not verify package signatures which could allow remote attackers to install trojan programs via DNS spoofing.
References
- yahoo-installer-insecure-connection(9984) vdb-entry
- 20020827 Yahoo Messenger Install Secuirty mailing-list
- 5579 vdb-entry