About Me

Wei Wang

Wei Wang

Read More

Feeds & Podcasts

Blogs

Meet the Bloggers

Archive

Tags

#SecChat $1 million guarantee 12 Scams of Christmas access to live fraud resolution agents Acquisition Alex Thurber Android antivirus Apple botnet Channel Partners cloud security Compliance Consumer counter identity theft credit card fraud and protection credit fraud alerts credit monitoring credit monitoring and resolution critical infrastructure Cyber Security Mom cyberbullying Cybercrime cybermom data breach data center data center security Data Protection Dave DeWalt DLP Email & Web Security embedded encryption Endpoint Protection enterprise facebook fake anti-virus software Family Safety Friday Security Highlights global threat intelligence google government Hacktivism how to talk to kids how to talk to teens identity fraud identity fraud scams identity protection identity protection $1 million guarantee identity protection fraud identity protection surveillance identity surveillance identity theft identity theft expert identity theft fraud identity theft protection identity theft protection product Identity thieves and cybercriminals intel iphone kids online behavior lost wallet protection malware McAfee McAfee Channel McAfee Family Protection McAfee Identity Protection McAfee Initiative to Fight Cybercrime McAfee Labs McAfee security products Mid-Market Mobile mobile malware mobile security monitor credit and personal information Network Security online personal data protection online safety Operation Aurora PCI personal identity theft fraud personal information loss personal information protection phishing privacy proactive identity protection proactive identity surveillance Public Sector restore credit and personal identity Risk and Compliance scam scams scareware security smartphones social media social networking social networks spam Stuxnet twitter vulnerability Web 2.0 work with victim restore identity

McAfee Labs :

Update: More on the Yahoo Messenger Webcam Zero-Day

Wednesday, August 15, 2007 at 8:42am by Wei Wang
Wei Wang

[UPDATE]
Yahoo has fixed its Webcam vulnerability. The patches for the Webcam vulnerabilities have been released by Yahoo. We urge Yahoo Messenger users to download the latest Messenger. Thanks to the Yahoo security team for working with us to resolve this issue in a short time. Here’s what you need to know.

[Original blog:]
Earlier today Karthik had blogged about details of a new zero day in Yahoo! Messenger being published on some security forums in China, we got a chance to dig a bit deeper into this and were able to reproduce the vulnerability on Yahoo! Messenger version 8.1.0.413 based on the information provided in the forum. It seems like a classic heap overflow which can be triggered when the victim accepts a webcam invite. Note that this vulnerability is different from the recently patched one in June which exploited the Yahoo! Webcam ActiveX controls. 

We’ve been able to reach Yahoo! security team and have informed them about this issue. 

We recommend the following to users using Yahoo! Messenger Webcam:

1) Don’t accept webcam invites from untrusted sources until a patch for this is released.

2) It’s advisable to block outgoing traffic on TCP port 5100 until the vendor patches this vulnerability.

To mitigate this, we’re releasing our NIPS IntruShield signatures today to protect Yahoo! Messenger users from this threat. We shall keep on monitoring this threat and update if we come across anything.

Bookmark and Share

Submit your own comments / message for this post

Your email is never published nor shared. Required fields are marked *

 

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>

Comments (13)

  • Alloushy August 30, 2007 9:28AM

    i beleive that all people should trust each other ” on yahoo ” and open cams to each other no time to be selfish no time to say no because life is to short so open ur cam and lets have fun :D

    Reply
  • Fate_ality August 24, 2007 9:01PM

    Chet, we are amoungst Morons :-

    Reply
  • Diana August 23, 2007 3:12PM

    Please people use common sence don’t view cams from those you don’t know……..Enough of that though………….WHEN is Yahoo going to fix the rest of the problems???? Hell you can’t even go to a chatroom

    Reply
  • tommy grana August 22, 2007 12:05PM

    please advise when patch is redy for download thank you tommy grana

    Reply
  • jose August 22, 2007 2:22AM

    if you dont accept web cam so you want to chat with people you even dont know what he look like well thats good for us because we are ugly.

    Reply
  • jose August 22, 2007 2:17AM

    its ok as long as it is not money matter or is these another that they need your credit card

    Reply
  • qq2006 August 20, 2007 5:41PM

    in the team509.com , I found the other two 0day , one about MSN messenger , he said it affect 7.x,8.0 ,MSN 8.1 have patched the vul , but why I can’t find Advisory in ms security bulletin, who can test it? I’m using MSN messenger 7.5 now , ;( .

    The other one about MPC(media player classic), I test on my MPC, it worked, there is a patch for it?

    there are the two links:
    http://www.team509.com/modules.php?name=News&file=article&sid=50
    http://www.team509.com/modules.php?name=News&file=article&sid=38

    Reply
  • fefe August 20, 2007 8:08AM

    wowo thats great macfee is going to help yahoo!! coming to any company we all expernce a pit fall once and a while and its good that pple join in to help good job macafee

    Reply
  • qwerty2001 August 17, 2007 4:09PM

    Obviously, Mr. Sam Wheat doesnot know the difference between a publicly released vulnerability information in a public forum like xfocus (do you even know how popular xfocus is in china and other places?) and paying for zero days and sponsoring zero days.
    I believe that this blog is for technical discussions and keeping track of interesting trends and threats. So, if you have a personal dig at the author (Rahul) please contact him in person. Saves your time and others as well. (Why do i have a feeling that you are a representative of ZDI???) ;)

    Chill mate! You are missing the point completely here.

    As regards the blog, Wei Wang good information for us. I shall keep track of this and please do inform the community in case you see any active exploitation on this issue. And yes i agree with the comments to people that we should never accept webcam invites….EVER!

    Reply
  • jay August 17, 2007 8:03AM

    Mr. Abrams,

    Where I agree with you in practice, it is simply a fact that not everyone on yahoo or anywhere else is a technilogical expert. Although many on Yahoo! seem to think they are. Most users of chat are the every day “Joe.” They don’t know the difference between malicious code and a pornographic link sent to their Instant Message box. Most people will click on anything that pops up on their screen. Of course the proper advice would be for no one to accept ANYTHING even from so called “trusted” sources, because after all who can one trust on the Internet? But one has to be realistic in realising that there are going to be many out there who will accept even if they don’t know the person sending. The PROPER advice is to NOT accept ANY webcam invites. Period.

    Reply
  • Ian Kenefick August 17, 2007 8:00AM

    In a chatroom full of users you’ve never met before how can you EVER truly trust them? Whose to say that those you’ve met and spoken with in IM aren’t a part of a social engineering ploy. The proper advice is to reject cam invites until the threat is mitigated by a patch.

    Reply
  • Sam Wheat August 17, 2007 6:12AM

    Wait a minute, is McAfee publicizing an unpatched zero-day issue here, thereby creating “hype and FUD by giving the world a chance to exploit” it? Quick, someone tell Rahul! I’m sure he’ll be incensed by McAfee’s irresponsible actions that put at risk the “Internet community at-large” who aren’t McAfee customers and are Yahoo Webcam users by arming up non-Chinese hackers who wouldn’t have heard of this.

    Reply
  • abrams@eset.com August 16, 2007 10:43AM

    I’m shocked that you would suggest it is ever a good idea to accept webcam invites from untrusted sources. The proper advice is not to accept webcam invites from untrusted sources at anytime. The release of a patch does not make dealing with untrusted sources a safe practice.

    Randy Abrams
    Director of Technical Education
    ESET LLC

    Reply