Get Smart about Business Spending
Yahoo IM affected by ActiveX vulnerabilities
On the heels of ActiveX vulnerabilities in the image uploading tools for Facebook and MySpace.com, researchers warned Monday that Yahoo Instant Messenger and Yahoo Messenger are vulnerable to ActiveX-based attacks.
Researcher Elazar Broad has disclosed a Boundary Condition vulnerability within mediagrid.dll, version 2.2.2 56. Researchers Krystian Kloskowski and Broad have disclosed a second Boundary Condition vulnerability within datagrid.dll, version 2.2.2 56c. And Kloskowski alone has disclosed a buffer overflow within datagrid.dll 2.2.2 56, which affects the AddImage function.
The three vulnerabilities are present within Yahoo Instant Messenger version 3.5 and Yahoo Messenger versions 4.0, 5.0, and 5.5, and could allow an attacker to compromise affected systems.
There are no known public exploits for these at this time. There is no patch available.
The existing workaround includes enabling the ActiveX control for each. Microsoft provides more details here . The specific CLSIDs for the ActiveX controls involved are:
Yahoo! MediaGrid: CLSID 22FD7C0A-850C-4A53-9821-0B0915C96139
Yahoo! DataGrid: CLSID 5F810AFC-BB5F-4416-BE63-E01DD117BD6C2
As CNET's resident security expert, Robert Vamosi has been interviewed on the BBC, CNN, MSNBC, and other outlets to share his knowledge about the latest online threats and to offer advice on personal and corporate security. Listen to his podcast at securitybites.cnet.com or e-mail Robert with your questions and comments. 
So since Yahoo! isn't thus far acquiescing to the buyout, Microsoft will go ahead and let slip different vulnerabilities in their software...?
As is the case with most ActiveX vulnerabilities. MS has nothing to do with writing the crappy code.
in South Korean, lots and lots of banks use ActiveX controls for data transfer. They write them correctly, and therefore don't have vulnerabilities.
Over here, people just blame MS....
- Certainly a conspiracy theory
- by hlywd217 February 4, 2008 5:28 PM PST
- haha nice
- Like this Reply to this comment
-
(3 Comments)