PT-2002-1133 · Yahoo · Yahoo! Messenger

Published 2002-07-26 · Updated 2008-09-05 · CVE-2002-0032

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Yahoo! Messenger versions 5.0.0.1064 and earlier

Description The issue allows remote attackers to execute arbitrary script as other users. This is achieved via the addview parameter of a ymsgr URI.

Recommendations For versions 5.0.0.1064 and earlier, avoid using the addview parameter in ymsgr URI until the issue is resolved.

Fix

Related Identifiers

CVE-2002-0032

Affected Products

Yahoo! Messenger

References · 6

• http://securityfocus.com/bid/4838 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2002-0032 · Security Note
• http://cert.org/advisories/CA-2002-16.html · Patch
• http://online.securityfocus.com/archive/1/274223 · Vendor Advisory
• http://kb.cert.org/vuls/id/172315 · Patch
• http://iss.net/security_center/static/9184.php · Note