full-disclosure - Yahoo Toolbar YShortcut.dll IsTaggedBM() Buffer Overflow

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <23342717.1198079789284.JavaMail.root@elwamui-karabash.atl.sa.earthlink.net>
Date: Wed, 19 Dec 2007 10:56:28 -0500 (EST)
From: Elazar Broad <elazarb@...thlink.net>
To: "full-disclosure@...ts.grok.org.uk" <full-disclosure@...ts.grok.org.uk>
Subject: Yahoo Toolbar YShortcut.dll IsTaggedBM() Buffer
	Overflow

YShortcut is a feature of the Yahoo toolbar which allows you to map shortcuts to URLS, i.e. y = http://www.yahoo.com and bla = http://www.somesite.com. The IsTaggedBM function is called every time anything is typed into the browsers address bar. This function suffers from an exploitable buffer overflow if 3000 characters is passed to it. Instead of doing their own bounds checking, Yahoo relies on the 2083 maximum URL length for Internet Explorer. This object is NOT marked safe for scripting.

YShortcut.dll, version 2006.8.15.1 
{67CE97C5-ABE6-429A-B6BD-3BD1333A0825}

Elazar

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/