--/NkBOFFp2J2Af1nK
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

---------------------------------------------------------------------
Yahoo! Security Advisory

Subject:    Yahoo! Voice Chat Control: buffer overflow
Announced:  2003-05-30
Affects:    Yahoo! Audio Conferencing versions prior to 1,0,0,45
            running on any version of Microsoft Windows
Corrected:  2003-05-30

1. Background

Yahoo! Audio Conferencing (commonly known as Yahoo! Voice Chat)
is a feature shared by Yahoo! Chat (a web-based service) and
Yahoo! Messenger (a win32 client application).

2. Problem Description

A buffer overflow exists in the Yahoo! Audio Conferencing
control that is shared by Yahoo! Messenger and Yahoo! Chat.

3. Impact

It may be possible for a remote attacker who can get a user to
view malicious html code, most likely executed by getting a user
to visit their Web page, to cause the user to be involuntarily
logged out of chat, crash the user's browser, or potentially
introduce executable code. To our knowledge, there have not been
any executable code exploits related to this issue.

4. Solution

An updated Yahoo! Audio Conferencing control must be installed.
The CLSID of the control is 2B323CD9-50E3-11D3-9466-00A0C9700498
and the corrected version number version is 1,0,0,45.

Users can test if they need to upgrade and install the update by
visiting http://messenger.yahoo.com/messenger/security

Yahoo! Messenger users will be prompted to update upon sign-in.
Yahoo! Chat users will be served the new ActiveX control when
entering a chat room.  The update page will also be linked to
from the Yahoo! Chat and Yahoo! Messenger home pages.

5. Workaround

The control can be disabled by removing the object from the
Internet Explorer "Downloaded Program Files" cache and, if
Yahoo! Messenger is installed, going into the Yahoo! Messenger
directory (by default, C:\Program Files\Yahoo!\Messenger\) and
running the following command:

  regsvr32 /u yacscom.dll

6. Acknowledgments

Cesar <sqlsec@yahoo.com> discovered and reported this vulnerability.


--/NkBOFFp2J2Af1nK
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.0 (FreeBSD)

iD8DBQE+192G3fgWi2Pp668RAkYBAJ4ooxsMMIaAvh9yDGOEu/7ZGNrAHgCfTYTG
tgh5H5sEp47n0yJQYc0GFCE=
=tCaA
-----END PGP SIGNATURE-----

--/NkBOFFp2J2Af1nK--