Yahoo! Messenger vulnerabilities: exploiting has begun

19th June 2007

Tomorrow we have announced several vulnerabilities, which were exposed in Yahoo! Messenger, the technical details of which were not openly disclosed. But this did not prevent hackers from successful exploiting of one of them. Attacks were made through the error of buffer overfilling of ActiveX component in Yahoo! Messenger Webcam, which allows launching on a computer arbitrary software code on the performance. First, the vulnerability was known in the last week to eEye Company, predicting the quick spread of attacks through this vulnerability. The exploiting of the vulnerability is possible in Yahoo! Messenger from 5.5.0 to 8.0.0 versions including. As it turned out, only users of the version 8.1 can feel immune, that`s why all the owners of IM-client are strongly recommended to install the currently latest update 8.1.0.401. Fortunately, Yahoo quite quickly has released the necessary “patch”.