From: deblanc01 at yahoo.com (De Blanc)
Subject: RE: Yahoo Instant Messenger YAUTO.DLL buffer overflow

Yeah! Yahoo is sux. Yahoo Messenger has tons of bugs.
But you are more sux than yahoo since you stole my
work and posted my found bug to yahoo and bugtraq.
Funny enough when your little company SentryUnion is
trying to sell "Indetify Theft" protection service but
you got owned, stole mail and money from your paypal
account, logged everything your chatted with gf via
one another yahoo messenger 0day. 

Stop leaking and killing my bug kid. Go to school to
learn more.

The Blanc

<trihuynh@...up.com> wrote:
>Hi all,
>This bug is a lame bug, very lame actually. I release
it in order to
>show that how a big company don't even do a basic QA.
If we look through
>the security records of YIM, almost any YIM's
ActiveX/Com
>components do have some kind of buffer overflow and
it is very easy
>to spot them too (by fuzzing the IDispatch
interface). I have no idea
>how can QA guys in the YIM project can manage to let
these
>dangerous bugs survival through the testing state.
Maybe they
>are so busy watching the new "Joe Millionaire" show
:-))))
>Trihuynh
>Sentryunion
>-----Original Message-----
>From: full-disclosure-admin@...ts.netsys.com
>[mailto:full-disclosure-admin@...ts.netsys.com] On
Behalf Of Tri Huynh
>Sent: Wednesday, December 03, 2003 10:07
>To: full-disclosure@...ts.netsys.com;
bugtraq@...urityfocus.com
>Cc: bugs@...uritytracker.com; news@...uriteam.com;
vuln@...unia.com
>Subject: [Full-Disclosure] Yahoo Instant Messenger
YAUTO.DLL buffer overflow
>
>Yahoo Instant Messenger YAUTO.DLL buffer overflow
>=================================================
>PROGRAM: Yahoo Instant Messenger (YIM)
>HOMEPAGE: http://messenger.yahoo.com
>VULNERABLE VERSIONS: 5.6.0.1347 and below
>
>DESCRIPTION
>=================================================
>YIM is one of the most popular instant messenger.
This is a cool product,
>that allows me to chat with my gf from a very long
distant :-).
>
>DETAILS
>=================================================
>YAUTO.DLL is an ActiveX/COM component that comes with
Yahoo Install
>Messenger. YAUTO.DLL is registered under a ProgID
called "YAuto.NSAuto.1".
>In this component, there is a function named
Open(String Url) that will
>cause a buffer overflow if argument Url is passed
with a long string. Since
>this is an ActiveX component, the vulnerability can
be exploited just by
>making a website with the correct CLSID of the
ActiveX and call the function
>directly. We have successfully exploited the
vulnerability by making a
>website that can download a trojan and execute it
silently.
>
>WORKAROUND
>=================================================
>Yahoo has been contacted at
enterprisesales@...oo-inc.com (this is the only
>email that I can find on the Yahoo Messenger Site)
but doesn't response
>after 1 month. The workaround solution is deleting
the YAUTO.DLL file in
>your YIM directory.
>
>CREDITS
>=================================================
>Discovered by Tri Huynh from SentryUnion
>
>DISLAIMER
>=================================================
>The information within this paper may change without
notice. Use of this
>information constitutes acceptance for use in an AS
IS condition. There are
>NO warranties with regard to this information. In no
event shall the author
>be liable for any damages whatsoever arising out of
or in connection with
>the use or spread of this information. Any use of
this information is at the
>user's own risk.
>
>FEEDBACK
>=================================================
>Please send suggestions, updates, and comments to:
trihuynh@...up.com
>_______________________________________________
>Full-Disclosure - We believe in it.
>Charter:
http://lists.netsys.com/full-disclosure-charter.html
>
>
>--------------------------------------------------------------------
>mail2web - Check your email from the web at
>http://mail2web.com/ .
>
>_______________________________________________
>Full-Disclosure - We believe in it.
>Charter: http://lists.netsys.com/full-disclosure-charter.html

__________________________________
Do you Yahoo!?
Free Pop-Up Blocker - Get it now
http://companion.yahoo.com/

Powered by blists - more mailing lists