Home / vulnerabilities Yahoo! Messenger 11.5.0.228 Buffer Overflow
Posted on 04 September 2015
Source : packetstormsecurity.org Link
RCE Security Advisory
https://www.rcesecurity.com
1. ADVISORY INFORMATION
-----------------------
Product: Yahoo! Messenger
Vendor URL: www.yahoo.com
Type: Stack-based Buffer Overflow [CWE-121]
Date found: 2014-05-02
Date published: 2015-09-03
CVSSv3 Score: 4,8 (AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L)
CVE: CVE-2014-7216
2. CREDITS
----------
This vulnerability was discovered and researched by Julien Ahrens from
RCE Security.
3. VERSIONS AFFECTED
--------------------
Yahoo! Messenger v11.5.0.228 (latest)
Yahoo! Messenger v10.0.0.2009
older versions may be affected too.
4. INTRODUCTION
---------------
Yahoo Messenger is the premier instant messaging (IM) platform, used on
a wide variety of desktop and mobile clients. Millions of users
throughout the world depend on Yahoo Instant Messenger to manage their
social contacts, group lists, and presence information; hold real-time
instant communications; and perform data transfer to and from contacts
throughout the world. All instantly.
(from the vendor's homepage)
5. VULNERABILITY DESCRIPTION
----------------------------
Multiple buffer overflow vulnerabilities have been identified in Yahoo!
Messenger v11.5.0.228 and prior.
The application loads the content of the file emoticons.xml from two
different directories %PROGRAMFILES(x86)%Yahoo!MessengerCache and
%PROGRAMFILES(x86)%Yahoo!MessengerMediaSmileys when a user logins to
determine the available emoticons and their associated shortcuts, which
can be used in the chat window. But the application does not properly
validate the length of the string of the "shortcut" and "title" key
values before passing them as an argument to different lstrcpyW calls.
This leads to a stack-based buffer overflow condition, resulting in
possible code execution. An attacker needs to trick the victim to copy
an arbitrary emoticons package to the application directory in order to
exploit the vulnerability. Successful exploits can allow attackers to
execute arbitrary code with the privileges of the user running the
application. Failed exploits will result in a denial-of-service condition.
6. PROOF-OF-CONCEPT (VULNERABLE CODE PARTS)
-------------------------------------------
YahooMessenger.exe:
title value:
0051D2C1 PUSH DWORD PTR DS:[EAX] ; /String2
0051D2C3 LEA EAX,DWORD PTR SS:[EBP] ; |
0051D2C6 PUSH EAX ; |String1
0051D2C7 CALL DWORD PTR DS:[<&KERNEL32.lstrcpyW>; lstrcpyW
shortcut value:
0051D326 PUSH DWORD PTR DS:[ESI+4] ; /String2
0051D329 LEA EAX,DWORD PTR SS:[EBP] ; |
0051D32C PUSH EAX ; |String1
0051D32D CALL DWORD PTR DS:[<&KERNEL32.lstrcpyW>>; lstrcpyW
7. SOLUTION
-----------
None. Won't be fixed.
8. REPORT TIMELINE
------------------
2014-05-02: Discovery of the vulnerability
2014-05-03: Reported via Yahoo! Bug Bounty program (hackerone.com)
2014-07-19: Vendor forwards the issue to the dev team
2014-08-31: Request for status update due to Yahoo's 120-day policy
2014-09-10: Vendor is still evaluating the issue
2014-09-20: Vendor closes the issue as "Won't fix" due to EOL
2014-10-01: MITRE assigns CVE-2014-7216
2014-10-05: Request to disclose the bug publicly
2015-08-14: Vendor approves the disclosure
2015-09-03: Advisory released
9. REFERENCES
-------------
https://www.rcesecurity.com/2015/09/cve-2014-7216-a-journey-through-yahoos-bug-bounty-program
https://hackerone.com/reports/10767
