PT-2006-7205 · Yahoo · Yahoo! Messenger

Publicado 2006-12-15 · Atualizado 2011-03-08 · CVE-2006-6603

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Yahoo! Messenger versions prior to 2005.1.1.4

Description A buffer overflow issue exists in the YMMAPI.YMailAttach ActiveX control, which can be exploited by remote attackers to execute arbitrary code via a crafted HTML document.

Recommendations For versions prior to 2005.1.1.4, update to version 2005.1.1.4 or later to resolve the issue. As a temporary workaround, consider disabling the YMMAPI.YMailAttach ActiveX control until a patch is applied.

Correção

Identificadores relacionados

CVE-2006-6603

Produtos afetados

Yahoo! Messenger

Referências · 7

• http://secunia.com/advisories/23401 · Aviso do Fabricante
• http://messenger.yahoo.com/security_update.php?id=120806 · Aviso do Fabricante
• http://kb.cert.org/vuls/id/901852 · Correção
• http://securitytracker.com/id?1017387 · Correção
• http://vupen.com/english/advisories/2006/5016 · Nota
• http://securityfocus.com/bid/21607 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2006-6603 · Nota de Segurança