PT-2006-7205 · Yahoo · Yahoo! Messenger

Published 2006-12-15 · Updated 2011-03-08 · CVE-2006-6603

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Yahoo! Messenger versions prior to 2005.1.1.4

Description A buffer overflow issue exists in the YMMAPI.YMailAttach ActiveX control, which can be exploited by remote attackers to execute arbitrary code via a crafted HTML document.

Recommendations For versions prior to 2005.1.1.4, update to version 2005.1.1.4 or later to resolve the issue. As a temporary workaround, consider disabling the YMMAPI.YMailAttach ActiveX control until a patch is applied.

Fix

Related Identifiers

CVE-2006-6603

Affected Products

Yahoo! Messenger

References · 7

• http://secunia.com/advisories/23401 · Vendor Advisory
• http://messenger.yahoo.com/security_update.php?id=120806 · Vendor Advisory
• http://kb.cert.org/vuls/id/901852 · Patch
• http://securitytracker.com/id?1017387 · Patch
• http://securityfocus.com/bid/21607 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2006-6603 · Security Note
• http://vupen.com/english/advisories/2006/5016 · Note