Description
Buffer overflow in a certain ActiveX control in YVerInfo.dll before 2007.8.27.1 in the Yahoo! services suite for Yahoo! Messenger before 8.1.0.419 allows remote attackers to execute arbitrary code via unspecified vectors involving arguments to the (1) fvCom and (2) info methods. NOTE: some of these details are obtained from third party information.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 1 module
-
Yahoo! Messenger YVerInfo.dll ActiveX Control Buffer Overflow
exploit/windows/browser/yahoomessenger_fvcom
Exploit-DB 2
- Yahoo! Messenger - 'YVerInfo.dll' ActiveX Control Buffer Overflow (Metasploit) EDB-16522 · remote · May 9, 2010 · verified
- Yahoo! Messenger - 'YVerInfo.dll 2007.8.27.1' ActiveX Buffer Overflow EDB-4351 · remote · Sep 1, 2007 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 37739 vdb-entry
- 26579 third-party-advisory
- yahoo-messenger-yverinfo-bo(36363) vdb-entry
- http://messenger.yahoo.com/security_update.php?id=082907
- 20070830 Yahoo Messenger YVerInfo.dll ActiveX Multiple Remote Buffer Overflow Vulnerabilities third-party-advisory
- 3083 third-party-advisory
- 1018628 vdb-entry
- 25494 vdb-entry
- ADV-2007-3011 vdb-entry