Update for Yahoo Messenger
The vendor has released an update for the vulnerability discovered about a week ago in Yahoo Messenger. This vulnerability can be exploited using invitations to webcam sessions to inject arbitrary code. In the interim, further details about the security vulnerability have been announced.
A vulnerability allows malicious code to be injected using specially crafted JPEG 2000 data streams, which Yahoo's Messenger uses for webcam sessions. A heap overflow can occur during the processing of manipulated data streams. A second vulnerability, which can be exploited if a user accepts a webcam invitation, only causes the software to crash.
The vulnerabilities reside in the files kdv_v32M.dll previous to Version 220.127.116.11 and ywcvwr.dll previous to Version 18.104.22.168, which are included in Yahoo Messenger 22.214.171.1243 and previous versions. The vendor has provided a download of a vulnerability-free version. Users of the software should install the update as soon as possible.
- Zero-day vulnerability in Yahoo Messenger, heise Security on August 16, 2007
- Yahoo! Messenger webcam stream heap overflow, security advisory from US-CERT
- Yahoo! Webcam, summary of changes in the update from Yahoo
- Download of the current version of the Yahoo Messenger