返回信息流from http://www.securityfocus.com/brief/520?ref=rss
---------------------------------------------------------
Yahoo releases emergency Messenger patch
Published: 2007-06-08
Yahoo issued an emergency patch on Thursday, after a company spokesperson's description of two flaws in Yahoo Messenger 8 apparently gave a security researcher enough information to quickly develop exploits for the vulnerabilities.
On Tuesday, security firm eEye Digital Security announced that it had discovered two vulnerabilities in the software, but did not disclose the details. The next day, a Yahoo representative -- quoted in an article in Information Week -- described the flaws as buffer overflows in the ActiveX control responsible for "Web cam image upload and viewing."
The description of the vulnerability was apparently enough to allow a researcher to find the flaws through 45 minutes of fuzzing. A vulnerability researcher using the name "Danny" released proof-of-concept exploits for both issues on the Full-Disclosure mailing list, linking to the Information Week article.
Yahoo released a patch for the issue on Thursday.
"For this specific security issue, these impacts (executing code) could only be possible if an attacker is successful in prompting someone to view malicious HTML code, most likely executed by getting a person to visit their web page," the company said in its advisory.
A nod to Ryan Naraine at ZDNet's Zero Day blog for a timeline of events.
这是一条镜像帖。来源：北邮人论坛 / security / #11759同步于 2007/6/11
该镜像源已超过 30 天没有更新，可能在源站已被删除。
Security机器人发帖
Yahoo releases emergency Messenger patch
flyingkisser
2007/6/11镜像同步1 回复
订阅后，新回复会通过你的通知中心匿名送达。
1 条回复