Yahoo Messenger 8.1 Address Book Buffer Overflow

#####################################################################

XDisclose Advisory 		: XD100002
Vulnerability Discovered	: 10 April 2007 
Advisory Released 		: 17 July 2007
Credit 				: Rajesh Sethumadhavan

Class 				: Buffer OverFlow
			  	  Denial Of Service
Solution Status 		: Patched From Server Side
Vendor Status			: Reported
Vendor 				: Yahoo Inc
Vendor Website	 		: http://www.yahoo.com
Affected applications 		: Yahoo Messenger 8.1 and prior

CVE ID				: CVE-2007-3928
Bugtraq ID			: 24926
Secunia ID 			: 26066
Xforce ISS ID	 		: 35434
Security Tracker ID 		: 1018398
Securityreason ID 		: 2906

#####################################################################


Overview:
Yahoo! Inc. is an American computer services company with a mission
to "be the most essential global Internet service for consumers and
businesses". It operates an Internet portal, including the popular
Yahoo! Mail and Yahoo Messenger. According to Web trends Yahoo! is
the most visited website on the Internet today with more than 400
million unique users. The global network of Yahoo! websites received
3.4 billion page views per day on average as of October 2005.

Bufferoverflow vulnerability is discovered in Yahoo! Messenger.
Attackers can execute an arbitrary code with the privileges of the
victim user by tricking the user to add a malformed address book
entry.

Description:
Yahoo! Messenger is a widely used communicating program over the
Internet. A buffer overflow vulnerability is discovered in the Yahoo!
Messenger for Microsoft Windows. Buffer overflow occurs when Yahoo!
Messenger loads a specially crafted address book entry.

POC:
-Create a address book entry using yahoo portal with large amount of
'a' in "email address" textbox.
-Login to yahoo messenger
-Go to address book tab in yahoo messenger
-Place your mouse over the specially crafted address book entry
-Yahoo messenger will immediately crash

Exploitation Method:
-Send an address book to the victim with specially crafted address
-Social engineer the victim to place mouse over the imported address


Screenshot:

http://www.xdisclose.com/images/yahooaddressbof.jpg


Impact:
Successful exploitation may allows execution of arbitrary code with
Privilege of currently log users.

Solution:
Patch From Server Side.

Original Advisory:
http://www.xdisclose.com/advisory/XD100002.html


Credits:
Rajesh Sethumadhavan has been credited with the discovery of this vulnerability