PT-2007-2218 · Yahoo · Yahoo! Messenger

Publicado 2007-02-06 · Atualizado 2018-10-16 · CVE-2007-0768

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Yahoo! Messenger versions 8.1.0.209 and earlier

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities in the Contact Details functionality. These vulnerabilities allow user-assisted remote attackers to inject arbitrary web script or HTML via a javascript: URI in the SRC attribute of an IMG element to the First Name, Last Name, and Nickname fields.

Recommendations For Yahoo! Messenger versions 8.1.0.209 and earlier, consider disabling the Contact Details functionality until a patch is available to prevent exploitation of the XSS vulnerabilities. Restrict access to the First Name, Last Name, and Nickname fields to minimize the risk of arbitrary web script or HTML injection. Avoid using the SRC attribute of an IMG element with a javascript: URI in these fields until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Identificadores relacionados

CVE-2007-0768

Produtos afetados

Yahoo! Messenger

Referências · 8

• 🔥 https://exploit-db.com/exploits/29531 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-0768 · Nota de Segurança
• http://securityfocus.com/archive/1/458225/100/0/threaded · Nota
• http://securityfocus.com/archive/1/458494/100/0/threaded · Nota
• http://securityfocus.com/bid/22269 · Nota
• http://osvdb.org/31674 · Nota
• http://secunia.com/advisories/23928 · Aviso do Fabricante
• http://securityfocus.com/archive/1/458305/100/0/threaded · Nota