McAfee has been able to confirm a report on a Chinese language security forum of a serious vulnerability in the most recent version of the Yahoo chat client. Relying on a heap overflow, it allows hackers to tale over a computer simply by getting an unsuspecting person to accept a webcam invite.
At issue is a buffer-overflow vulnerability in Yahoo Messenger's Webcam ActiveX control. The exploit is put to work when an attacker crafts a malicious site designed to take advantage of the vulnerability. The attacker then lures victims to the site by sending the exploit code via e-mail or hosting it in a remotely accessible location.
A Yahoo representative confirmed the vulnerability and said company software developers are scrambling to fix it. Affected versions range from Yahoo Messenger 5.5.0 on up to 8.0.0 and those versions in between. Yahoo Messenger 8.1 isn't affected. Users should immediately upgrade to the version Yahoo put out to fix the problem late last week: Version 8.1.0.401, posted at
http://messenger.yahoo.com/webmessengerpromo.php
In the meantime, Yahoo Messenger users may want to block outgoing traffic on port 5100 and don't accept any invites.
No comments:
Post a Comment