[ insider_reports_insider ]
Yahoo Webcam Exploits Emerge
David Utter
Staff Writer
2007-06-07
 Insider Reports RSS Feed
A pair of zero-day exploits for part of Yahoo's Messenger service can cause arbitrary code execution at the user's level of access.
 | | Yahoo Webcam Exploits Emerge |  |
The high severity of the ActiveX flaws noted by eEye in their Zero-Day Tracker could mean trouble for users of Yahoo Messenger.
"ActiveX remote code execution vulnerabilities have very high impacts since the source of the malicious payload can be any site on the Internet," eEye said in its assessment.
"An even more critical problem is generated when clients are administrators on their local hosts, which would run the malicious payload with Administrator credentials."
Two proof-of-concept exploits have been posted in the archives of the Full-disclosure mailing list maintained by security consulting firm Neohapsis.
Yahoo has not issued a patch for these exploits.
However, eEye suggested a mitigation strategy in its advisory to disable calls to the vulnerable ActiveX controls from web pages.
That suggested the nature of the exploits could be of the drive-by variety, affecting people who simply pull up a malicious site in their browsers.
You Really Can't Trust The Media:
The long-time practice of sending spam and malware as an email with a current event-oriented headline comes and goes, but never truly leaves.
F-Secure noted the recent resurgence in this type of spam. SANS Internet Storm Center reported on some real-life headlines showing up in spam.
These are being accompanied by password-protected Zip archived files that contain a Trojan file.
Filenames attached to these archives makes them appear to be from news organizations.
They aren't, of course, but they do require email users to play reporter and exhibit some skepticism when receiving spam of this nature.
---
Tag: Yahoo Webcam
About the Author:
David Utter is a business and technology writer for SecurityProNews and WebProNews.
More insider_reports_insider Articles
Insider Reports RSS Feed
|
|
iEntry 10th Anniversary
RSS
Archive
