---------------------------------------------------------------------
Yahoo! Security Advisory
Subject: Yahoo! Voice Chat Control: buffer overflow
Announced: 2003-05-30
Affects: Yahoo! Audio Conferencing versions prior to 1,0,0,45
running on any version of Microsoft Windows
Corrected: 2003-05-30
1. Background
Yahoo! Audio Conferencing (commonly known as Yahoo! Voice Chat)
is a feature shared by Yahoo! Chat (a web-based service) and
Yahoo! Messenger (a win32 client application).
2. Problem Description
A buffer overflow exists in the Yahoo! Audio Conferencing
control that is shared by Yahoo! Messenger and Yahoo! Chat.
3. Impact
It may be possible for a remote attacker who can get a user to
view malicious html code, most likely executed by getting a user
to visit their Web page, to cause the user to be involuntarily
logged out of chat, crash the user's browser, or potentially
introduce executable code. To our knowledge, there have not been
any executable code exploits related to this issue.
4. Solution
An updated Yahoo! Audio Conferencing control must be installed.
The CLSID of the control is 2B323CD9-50E3-11D3-9466-00A0C9700498
and the corrected version number version is 1,0,0,45.
Users can test if they need to upgrade and install the update by
visiting http://messenger.yahoo.com/messenger/security
Yahoo! Messenger users will be prompted to update upon sign-in.
Yahoo! Chat users will be served the new ActiveX control when
entering a chat room. The update page will also be linked to
from the Yahoo! Chat and Yahoo! Messenger home pages.
5. Workaround
The control can be disabled by removing the object from the
Internet Explorer "Downloaded Program Files" cache and, if
Yahoo! Messenger is installed, going into the Yahoo! Messenger
directory (by default, C:\Program Files\Yahoo!\Messenger\) and
running the following command:
regsvr32 /u yacscom.dll
6. Acknowledgments
Cesar <sqlsecat_private> discovered and reported this vulnerability.
This archive was generated by hypermail 2b30 : Sun Jun 01 2003 - 13:14:59 PDT