CVE-2007-1680
Yahoo! Messenger AudioConf ActiveX Control Buffer Overflow Vulnerability
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Stack-based buffer overflow in the createAndJoinConference function in the AudioConf ActiveX control (yacscom.dll) in Yahoo! Messenger before 20070313 allows remote attackers to execute arbitrary code via long (1) socksHostname and (2) hostname properties.
Desbordamiento de búfer en la función createAndJoinConference en el control ActiveX AudioConf (yacscom.dll) en Yahoo! Messenger anterior a 20070313 permite a atacantes remotos ejecutar código de su elección a través de las propiedades (1) socksHostname y (2) hostname.
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Yahoo Messenger. User interaction is required to exploit this vulnerability in that the target must visit a malicious page.
The specific flaw exists within the ActiveX control Yahoo.AudioConf:
DLL: yacscom.dllCLSID: 2B323CD9-50E3-11D3-9466-00A0C9700498
When large values are specified for the 'socksHostname' and 'hostname' properties, and the createAndJoinConference() method is called, a stack overflow occurs. Exploitation can result in code execution under the context of the current user.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2007-03-26 CVE Reserved
- 2007-04-03 CVE Published
- 2024-02-07 EPSS Updated
- 2024-08-07 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
CAPEC
References (11)
| URL | Tag | Source |
|---|---|---|
| http://osvdb.org/34319 | Vdb Entry | |
| http://securityreason.com/securityalert/2523 | Third Party Advisory | |
| http://www.kb.cert.org/vuls/id/388377 | Third Party Advisory |
|
| http://www.securityfocus.com/archive/1/464607/100/0/threaded | Mailing List | |
| http://www.securitytracker.com/id?1017867 | Vdb Entry | |
| http://www.vupen.com/english/advisories/2007/1219 | Vdb Entry | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/33408 | Vdb Entry |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://messenger.yahoo.com/security_update.php?id=031207 | 2018-10-16 | |
| http://secunia.com/advisories/24742 | 2018-10-16 | |
| http://www.securityfocus.com/bid/23291 | 2018-10-16 | |
| http://www.zerodayinitiative.com/advisories/ZDI-07-012.html | 2018-10-16 |
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Yahoo Search vendor "Yahoo" | Messenger Search vendor "Yahoo" for product "Messenger" | 8.0 Search vendor "Yahoo" for product "Messenger" and version "8.0" | - |
Affected
| ||||||
| Yahoo Search vendor "Yahoo" | Messenger Search vendor "Yahoo" for product "Messenger" | 8.0.0.863 Search vendor "Yahoo" for product "Messenger" and version "8.0.0.863" | - |
Affected
| ||||||
| Yahoo Search vendor "Yahoo" | Messenger Search vendor "Yahoo" for product "Messenger" | 8.0_2005.1.1.4 Search vendor "Yahoo" for product "Messenger" and version "8.0_2005.1.1.4" | - |
Affected
| ||||||
| Yahoo Search vendor "Yahoo" | Messenger Search vendor "Yahoo" for product "Messenger" | 8.1.0.209 Search vendor "Yahoo" for product "Messenger" and version "8.1.0.209" | - |
Affected
| ||||||
| Yahoo Search vendor "Yahoo" | Messenger Search vendor "Yahoo" for product "Messenger" | 8.1.0.239 Search vendor "Yahoo" for product "Messenger" and version "8.1.0.239" | - |
Affected
| ||||||