Danny has discovered two vulnerabilities in Yahoo! Messenger, which can be exploited by malicious people to compromise a user's system.

1) A boundary error within the Yahoo! Webcam Upload (ywcupl.dll) ActiveX control can be exploited to cause a stack-based buffer overflow by assigning an overly long string to the "Server" property and then calling the "Send()" method.

2) A boundary error within the Yahoo! Webcam Viewer (ywcvwr.dll) ActiveX control can be exploited to cause a stack-based buffer overflow by assigning an overly long string to the "Server" property and then calling the "Receive()" method.

Successful exploitation of the vulnerabilities allows execution of arbitrary code.

The vulnerabilities are confirmed in version 8.1.0.249. Other versions may also be affected.

Solution
Update to the latest version.
Further details available to Secunia VIM customers

Provided and/or discovered by
Danny

Also independently discovered by:
Greg Linares, eEye Digital Security.

Changelog
Further details available to Secunia VIM customers

Original Advisory
Yahoo:
http://messenger.yahoo.com/security_update.php?id=060707

Full-Disclosure:
http://lists.grok.org.uk/pipermail/full-disclosure/2007-June/063817.html
http://lists.grok.org.uk/pipermail/full-disclosure/2007-June/063819.html

eEye Digital Security:
http://research.eeye.com/html/advisories/published/AD20070608.html

Other references
Further details available to Secunia VIM customers

Alternate/detailed remediation
Further details available in Customer Area

Deep Links
Links available to Secunia VIM customers