Exploit Code Out For Yahoo IM Flaws

Tweet

Code for two exploits in Yahoo Messenger first disclosed earlier this week by security firm eEye appeared on the Full Disclosure mailing list on Thursday. At the current time, the only fix is to set the 'kill bits' in the ActiveX controls responsible for the vulnerabilities, although it requires a system registry edit. Yahoo says it is working on a fix for both issues. The first set of code takes advantage of buffer overflow issues within the Webcam ActiveX component, while the other causes a buffer overflow in the ywcvwr.dll viewer. The issues affect both Yahoo Messenger 8.0 and 8.1 running on Windows. Note: This is an update to a news report I posted here on mylot a day or so ago. Basically I would advise people not to use their webcams on Yahoo messenger until these problems get fixed. If you want to use your webcam use MSN/Live Messenger.