CVE-2002-0031

Affected software: Yahoo! Messenger for Windows, version 5.0.0.1064 and earlier. Vulnerability: a remote buffer overflow in the Yahoo! Messenger URI handler (ymsgr:), sharing a single vulnerable buffer for multiple functions (e.g., getimv, sendim, message, addview, adduser, call, chat). Impact: m...

CVE-2002-0031

Buffer overflows in Yahoo! Messenger 5,0,0,1064 and earlier allows remote attackers to execute arbitrary code via a ymsgr URI with long arguments to 1 call, 2 sendim, 3 getimv, 4 chat, 5 addview, or 6 addfriend...

Advisory CA-2002-16 Multiple Vulnerabilities in Yahoo! Messenger

-----BEGIN PGP SIGNED MESSAGE----- CERT Advisory CA-2002-16 Multiple Vulnerabilities in Yahoo! Messenger Original release date: June 05, 2002 Last revised: -- Source: CERT/CC A complete revision history can be found at the end of this file. Systems Affected Yahoo! Messenger version 5,0,0,1064 and...

Multiple bugs in Yahoo Messenger

Multiple bugs including buffer overflows...

Yahoo! Messenger is vulnerable to DoS via multiple messages from spoofed names

Overview Yahoo! Messenger is an instant messaging client. A report indicates that there is a vulnerability that permits an attacker to spoof the source user name of a Yahoo! Messenger message. Description Yahoo! Messenger permits a user to place users on an ignore list. A vulnerability exists tha...

Yahoo! Messenger contains a buffer overflow in the URI handler

Overview Yahoo! Messenger is an instant messaging client. A remotely exploitable vulnerability has been reported in the URI handler of Yahoo! Messenger. Description A remotely exploitable buffer overflow exists in the URI handler of Yahoo! Messenger, versions 5,0,0,1064 and prior, that may permit...

Yahoo! Messenger allows arbitrary users to be added to buddy list without proper authorization

Overview Yahoo! Messenger is an instant messaging client. There is a vulnerability in Yahoo! Messenger that permits a remote user to add arbitrary users to the victim's buddy list. Description Yahoo! Messenger allows users to view content only from users on their buddy list. An attacker could cra...

Yahoo! Messenger contains a buffer overflow in "set_buddygrp" when adding users to a buddy list via the web

Overview Yahoo! Messenger is an instant messaging client. There is a remotely exploitable buffer overflow vulnerability in the "setbuddygrp" field of Yahoo! Messenger. Description A remotely exploitable buffer overflow exists in the "setbuddygrp" field that may permit a remote attacker to execute...

Yahoo! Messenger "addview" function allows for the automatic execution of malicious script contained in web pages

Overview Yahoo! Messenger is an instant messaging client. When installed, Yahoo! Messenger enables a URI handler ymsgr :parameter. The addview function of this handler can be used to execute arbitrary script/html on the local system. Description The addview feature of Yahoo! Messenger is used to...

Yahoo! Messenger contains buffer overflow in "IMvironment" field

Overview Yahoo! Messenger is an instant messaging client. There is a remotely exploitable buffer overflow vulnerability in the "imv" field of Yahoo! Messenger. Description A remotely exploitable buffer overflow exists in the "imv" field that may permit a remote attacker to execute arbitrary code ...

Yahoo! Messenger contains buffer overflow in "message" field

Overview Yahoo! Messenger is an instant messaging client. There is a remotely exploitable buffer overflow vulnerability in the "message" field of Yahoo! Messenger. Description A remotely exploitable buffer overflow exists in the "message" field that may permit a remote attacker to execute arbitra...

ymxp.txt

Yahoo! Messenger 5,0,0,1061 Buffer Overflow Exploit for Win XP Pro Intro: Proof of concept code for YM Buffer Overflow as discovered in: http://packetstorm.decepticons.org/advisories/misc/yahoo-im.txt Code flow: Overwrite EIP at 218 Point EIP to a "RET" in the memory "RET" jumps to beginning of...

Yahoo Messenger - Multiple Vulnerabilities

Yahoo! Instant Messenger YIM Hi-Jack 101-- Multiple Vulnerabilities & Demonstration Exploit Date : 05/02/2002 Version : Yahoo! Messenger 5, 0, 0, 1061 latest build at time Platforms : Win98, Win2K, XP Pro and likely all Windows versions Severity : Medium - High Contents : 01. Summary 02...

Yahoo! Messenger 5.0 - Call Center Buffer Overflow

Yahoo! Messenger 5.0 - Call Center Buffer Overflow // source: https://www.securityfocus.com/bid/4837/info Yahoo! Messenger configures the 'ymsgr:' URI handler when it is installed. The handler invokes YPAGER.EXE with the supplied parameters. YPAGER.EXE accepts the 'call' argument; it is used for...

Yahoo! Messenger 5.0 - Call Center Buffer Overflow

// source: https://www.securityfocus.com/bid/4837/info Yahoo! Messenger configures the 'ymsgr:' URI handler when it is installed. The handler invokes YPAGER.EXE with the supplied parameters. YPAGER.EXE accepts the 'call' argument; it is used for starting the 'Call Center' feature. There is a stac...

CVE-2002-0322

Yahoo! Messenger 4.0 sends user passwords in cleartext, which could allow remote attackers to gain privileges of other users via sniffing...

CVE-2002-0322

CVE-2002-0322 affects Yahoo! Messenger 4.0. The vulnerability arises because user passwords are sent in cleartext, enabling remote attackers to sniff credentials and potentially gain privileges of other users. The issue impacts confidentiality and integrity (partial), with a network-based attack ...

CVE-2002-0321

Yahoo! Messenger 5.0 allows remote attackers to spoof other users by modifying the username and using the spoofed username for social engineering or denial of service flooding attacks...

CVE-2002-0320

CVE-2002-0320: Buffer overflow in Yahoo! Messenger 5.0 allows a remote attacker to cause a denial of service and possibly execute arbitrary code via a long message or the IMvironment field. The CERT advisories specify a remotely exploitable overflow in the message field and in the IMvironment fie...

CVE-2002-0321

Yahoo! Messenger 5.0 is affected by a vulnerability that lets a remote attacker spoof another user’s name in messages, enabling social engineering or a denial-of-service via flooding. The issue arises from the ability to modify the source username used in messages. Impact is described as potentia...