********************************************************************************=0D
Product:=0D
Yahoo Messenger 9.0.0.2162=0D
=0D
=0D
********************************************************************************=0D
Vulnerability:=0D
ActiveX Null Pointer - Denial of Service=0D
=0D
=0D
********************************************************************************=0D
Description:=0D
Yahoo Messenger is prone to a denial-of-service (cause of null pointer) vulnerability.=0D
Vulnerability is in YahooBridgeLib.dll (Activex Control)=0D
=0D
An attacker can exploit this vulnerability by enticing an unsuspecting victim to view a malicious webpage. =0D
=0D
=0D
=0D
=0D
********************************************************************************=0D
Credits:=0D
HACKATTACK IT SECURITY GmbH=0D
Penetration Testing in Deutschland - =D6sterreich - Schweiz=0D
www.hackattack.com=0D 
=0D
=0D
=0D
=0D
********************************************************************************=0D
Debugger Results:=0D
=0D
(1910.1a18): Access violation - code c0000005 (!!! second chance !!!)=0D
eax=00000000 ebx=100092b4 ecx=018f0898 edx=002ae8d4 esi=00000000 edi=00000000=0D
eip=10001074 esp=002ae858 ebp=002ae8dc iopl=0         nv up ei pl zr na pe nc=0D
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010246=0D
*** WARNING: Unable to verify checksum for C:\Program Files\Yahoo!\Messenger\YahooBridgeLib.dll=0D
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\Program Files\Yahoo!\Messenger\YahooBridgeLib.dll - =0D
YahooBridgeLib+0x1074:=0D
10001074 8b08            mov     ecx,dword ptr [eax]  ds:0023:00000000=????????=0D
=0D
0:000> !analyze -v=0D
...=0D
...=0D
...=0D
PRIMARY_PROBLEM_CLASS:  NULL_POINTER_READ=0D
=0D
DEFAULT_BUCKET_ID:  NULL_POINTER_READ=0D
=0D
=0D
=0D
********************************************************************************=0D
PoC (.wsf script) :=0D
=0D
=0D
=0D
=0D
=0D