PT-2007-2218 · Yahoo · Yahoo! Messenger

Published 2007-02-06 · Updated 2018-10-16 · CVE-2007-0768

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Yahoo! Messenger versions 8.1.0.209 and earlier

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities in the Contact Details functionality. These vulnerabilities allow user-assisted remote attackers to inject arbitrary web script or HTML via a javascript: URI in the SRC attribute of an IMG element to the First Name, Last Name, and Nickname fields.

Recommendations For Yahoo! Messenger versions 8.1.0.209 and earlier, consider disabling the Contact Details functionality until a patch is available to prevent exploitation of the XSS vulnerabilities. Restrict access to the First Name, Last Name, and Nickname fields to minimize the risk of arbitrary web script or HTML injection. Avoid using the SRC attribute of an IMG element with a javascript: URI in these fields until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2007-0768

Affected Products

Yahoo! Messenger

References · 8

• 🔥 https://exploit-db.com/exploits/29531 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-0768 · Security Note
• http://secunia.com/advisories/23928 · Vendor Advisory
• http://securityfocus.com/archive/1/458225/100/0/threaded · Note
• http://securityfocus.com/archive/1/458494/100/0/threaded · Note
• http://securityfocus.com/bid/22269 · Note
• http://osvdb.org/31674 · Note
• http://securityfocus.com/archive/1/458305/100/0/threaded · Note