PT-2009-6339 · Yahoo · Yahoo! Messenger

Publicado 2009-12-02 · Atualizado 2018-10-10 · CVE-2009-4171

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Yahoo! Messenger version 9.0.0.2162 Yahoo! Messenger versions 9.0

Description The issue is related to an ActiveX control in YahooBridgeLib.dll, which allows remote attackers to cause a denial of service by calling the RegisterMe method with a long argument, resulting in a NULL pointer dereference and application crash.

Recommendations For Yahoo! Messenger version 9.0.0.2162, consider disabling the RegisterMe method until a patch is available. For other affected 9.0 versions, restrict access to the vulnerable ActiveX control in YahooBridgeLib.dll to minimize the risk of exploitation.

Exploit

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2009-4171

Produtos afetados

Yahoo! Messenger

Referências · 6

• 🔥 https://exploit-db.com/exploits/10092 · Exploit
• 🔥 http://securityfocus.com/bid/37007 · Exploit
• 🔥 https://exploit-db.com/exploits/33350 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-4171 · Nota de Segurança
• http://securityfocus.com/archive/1/507818/100/0/threaded · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/54263 · Nota