October 27, 2003
Hat-Squad Advisory: Buffer Overflow in Yahoo messenger Client

Vulnerable systems:
Yahoo! Messenger version 5.6.0.X

Vulnerability in Yahoo Messenger File Transfer option allows a remote attacker to shut down
the victim client.

The Yahoo messenger service filters some special characters in YahooID field like (x,&,?).When
attacker initiates a file send

request to victimID%%%%%%%%%(more than 73 chars), the service filters % chars and prompts
"victimID" for an incoming file

transfer session.If victim accepts the incoming file, his client will be shut down with access
violation error. The access

violation accurse in FT.DLL that is responsible for p2p YM file transfers.

sample download URL that the attacker client sends to victim machine :
6y 14 53

the above url is encoded.

Use this link
while you are logged into YM(note that the length of victim_yahooID plus %(or ? or &) chars
must be more than 73 chars.)
It will fire a YM file transfer window.if the victim accepts your file,his client will be

Found by:
Pejman davarzany
Hat-Squad Security Research Team (www.hat-squad.com)


Join Hat-Squad Mailing List

E-mail Address:


Copyright 2003-2004, Hat-Squad security Group, All rights reserved.