PT-2009-6339 · Yahoo · Yahoo! Messenger

Published 2009-12-02 · Updated 2018-10-10 · CVE-2009-4171

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Yahoo! Messenger version 9.0.0.2162 Yahoo! Messenger versions 9.0

Description The issue is related to an ActiveX control in YahooBridgeLib.dll, which allows remote attackers to cause a denial of service by calling the RegisterMe method with a long argument, resulting in a NULL pointer dereference and application crash.

Recommendations For Yahoo! Messenger version 9.0.0.2162, consider disabling the RegisterMe method until a patch is available. For other affected 9.0 versions, restrict access to the vulnerable ActiveX control in YahooBridgeLib.dll to minimize the risk of exploitation.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2009-4171

Affected Products

Yahoo! Messenger

References · 6

• 🔥 https://exploit-db.com/exploits/10092 · Exploit
• 🔥 http://securityfocus.com/bid/37007 · Exploit
• 🔥 https://exploit-db.com/exploits/33350 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-4171 · Security Note
• http://securityfocus.com/archive/1/507818/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/54263 · Note