PT-2002-3073 · Yahoo · Yahoo! Messenger

Published 2002-12-31 · Updated 2008-09-05 · CVE-2002-2361

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Yahoo! Messenger versions 4.0 through 5.5

Description The issue concerns the installer in Yahoo! Messenger, which does not verify package signatures. This could allow remote attackers to install trojan programs via DNS spoofing.

Recommendations For Yahoo! Messenger versions 4.0 through 5.5, consider updating to a newer version that includes signature verification to prevent the installation of trojan programs.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2002-2361

Affected Products

Yahoo! Messenger

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2002-2361 · Security Note
• http://securityfocus.com/bid/5579 · Note
• http://cert.uni-stuttgart.de/archive/bugtraq/2002/08/msg00384.html · Note
• http://iss.net/security_center/static/9984.php · Note