Yahoo! Messenger 8.0.0.863 - File Extension Spoofing

2006-08-04T00:00:00
ID EXPLOITPACK:24123272BBC729AFDCE1E4525C1B2864
Type exploitpack
Reporter ivancool2003
Modified 2006-08-04T00:00:00

Description

Yahoo! Messenger 8.0.0.863 - File Extension Spoofing

                                        
                                            source: https://www.securityfocus.com/bid/19353/info

A vulnerability in Yahoo! Messenger allows remote attackers to spoof file extensions. This issue is due to a design error. 

An attacker may leverage this issue to spoof downloaded filenames to unsuspecting users. This issue may lead to a compromise of the target computer as well as other consequences. 

Yahoo! Messenger version 8.0.0.863 is reportedly affected; earlier versions may be affected as well.

Sample filenames and extensions have been provided:

example: Annakournikova and her friends.jpg~@~@~@~@~@~@~@~@~@~@~@~@~@~@~@~@~@~@~@~@~@~@~@~@~@~@~@~@~@~@~@~@~@~@~@~@~@~@~@~@.exe Trojan.txt~@~@~@~@~@~@~@~@~@~@~@~@~@~@~@~@.exe Info.txt~@~@~@~@~@~@~@~@~@~@~@~@~@~@.exe