Yahoo patches Messenger zero-day flaws

• READ
• COMMENTED
• SHARED

• Vodafone concedes FX Networks not to blame for outage
• New Zealand's internet filter goes live
• FX Networks denies mobile degradation role
• $30 billion reform kicks off with huge PC tender
• TelstraClear capitalises on XT's woes

• New Zealand's internet filter goes live
• Vodafone concedes FX Networks not to blame for outage
• Gattung slams her successor's salary
• $30 billion reform kicks off with huge PC tender
• Internet hit by wave of ransom malware

• Skills shortage to return, but with variations
• Health IT Board drafts e-health plan
• Northpower offers ISP Xf Net access to lit fibre
• NZTA revamps storage, looks to Saas and iSCSI
• IBM lays off staff, restructures local management

 

• SaaS ERP Has buzz, but who are the real players?
• The scientist as CIO
• CIO game on
• Let it reign
• Acting on opportunity

 

• SUBSCRIPTIONS
• NEWSLETTERS
• NEWSFEED

Computerworld is New Zealand's only specialised information systems fortnightly.

Subscribe now for $97.50 (24 issues) and save more than 37% off the cover price!

Get the latest news from Computerworld delivered via email.
Sign up now

Subscribe to Computerworld's
RSS newsfeed here and get news stories as they break.

• Hackers update malware tool kit with zero-day attack code

Yahoo has released a new version of its Messenger instant messaging client to patch a pair of zero-day vulnerabilities that let attackers grab control of a Windows PC with little or no help from the user.

The bugs in Messenger's Webcam ActiveX controls were reported last week by eEye Digital Security; within hours a researcher identified only as "Danny" had posted exploit code for both flaws on a security mailing list.

A day later, Yahoo had patched Messenger, posted the new version on its site and urged everyone to download and install it. The update isn't mandatory, however. "Over the next several weeks, users worldwide will be prompted to update to a new version of Messenger upon signing into the service," a company spokesman said in an email. "If you choose not to update, the vulnerability will still exist."

Nor is the update automatic, which means that users with older versions of Yahoo Messenger installed, but who no longer use the IM client, may never receive the warning. Infrequent users of Messenger will also be at risk until they update Yahoo's software.

A Yahoo security advisory also said that attacks would most likely come via malicious websites. "Some impacts of [the vulnerabilities] might include the introduction of executable code, being involuntarily logged out of a chat and/or instant messaging session, and the crash of an application such as Internet Explorer."

Because Yahoo had posted the patched edition, eEye updated its advisory with additional information on the vulnerabilities and how they could be exploited by attackers. Normally, said eEye, the two buggy ActiveX controls are used only when viewing or streaming webcam video content to and from Messenger.

"But they are incorrectly marked safe for scripting and [so] can be instantiated by any website," eEye's new advisory read. That means an attacker with a malicious site can entice users there, then call on the flawed ActiveX controls without firing up Messenger and triggering the update alert. Also today, Danny the researcher updated his exploit code after others said they were unable to duplicate the vulnerabilities. Those testers have reported that the exploit updates work.

According to eEye, all versions of Windows are vulnerable to attack, except for Vista, since Yahoo has not yet finished a version for that operating system.

The updated Messenger for Windows 98, 2000, Millennium and XP is available for download.