Yahoo! Messenger 8.1 - Address Book Remote Buffer Overflow

source: https://www.securityfocus.com/bid/24926/info

Yahoo! Messenger is prone to a remote buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied data.

Attackers can exploit this issue to execute arbitrary code in the context of the application or to cause denial-of-service conditions.

Yahoo! Messenger 8.1 and prior versions are vulnerable.


1. Create an address book entry using Yahoo! portal with a large amount of 'a's in 'email address' textbox.
2. Log in to Yahoo! Messenger
3. Go to the address book tab
4. Place your mouse pointer over the specially crafted address book entry
5. Yahoo! Messenger will immediately crash