Secunia Research has discovered a vulnerability in Miranda IM, which can be exploited by malicious people to compromise a vulnerable system.

The vulnerability is caused due to a format string error within "ext_yahoo_contact_added()" in yahoo.c and can be exploited via a "Y7 Buddy Authorization" packet containing format string specifiers.

Successful exploitation allows execution of arbitrary code but requires that the user e.g. is tricked into connecting to a malicious server.

The vulnerability is confirmed in version 0.7.1.

Solution
Update to version 0.7.2.
Further details available in Customer Area

Provided and/or discovered by
Secunia Research

Changelog
Further details available in Customer Area

Original Advisory
Secunia Research:
http://secunia.com/secunia_research/2007-89/

Miranda IM:
http://www.miranda-im.org/2007/11/11/miranda-im-v072-released/

Deep Links
Links available in Customer Area