Yahoo Messenger hit with ninth zero-day exploit

The latest exploit on the Web can force-feed a malicious file to IM users

Attack code that targets Yahoo Messenger has been published on the Internet, a security researcher warned Wednesday, marking the ninth exploit aimed at the popular instant messaging software so far this year.

In a posting to the milw0rm.com Web site, someone identified as "shinnai" disclosed malicious Visual Basic code that allegedly lets attackers feed any file to users of the latest version of Messenger. The exploit code successfully executes on a fully-patched PC running Windows XP SP2, shinnai said, although the effect depends on the security settings of Internet Explorer (IE).

According to an e-mail alert from nCircle Network Security, hackers armed with the exploit could force-feed malware such as a Trojan horse to vulnerable users. It was nCircle that pegged the latest zero-day threat against Messenger as No. 9 for the year.

IE's security, however, can mitigate an attack. Users running the newer IE 7 with default security settings will probably be protected.

"This latest exploit is another data point in the strong trend toward IM client attacks," said Andrew Storms, nCircle's director of security operations. "IM vendors jockeying for market share are trying to lure new users with new features that also open up new risks to end users."

Storms was referring to the rash of instant messaging program flaws that have been uncovered in recent months. Yahoo Messenger, for example, has been patched several times this summer, while Microsoft decided less than a week ago on a mandatory upgrade that meant all users of its MSN Messenger and Windows Live Messenger clients had to update or lose access to the service.

Storms recommended that corporate IT admit that unauthorized instant messaging software is being used on their networks. "Enterprise IT teams that have been ignoring IM clients because they are not part of the 'official' infrastructure would be well advised to take steps to bring an IM client onto their supported platform and make sure their antivirus and spyware vendors work with their selected client," he said in an e-mail.

Yahoo, which patched Messenger twice last month, did not immediately respond to a request for confirmation of the newest flaw and queries about a patch timeline.

Join the Good Gear Guide newsletter!

Error: Please check your email address.

Struggling for Christmas presents this year? Check out our Christmas Gift Guide for some top tech suggestions and more.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Gregg Keizer

Computerworld

Most Popular Reviews

Follow Us

Best Deals on GoodGearGuide

Shopping.com

Latest News Articles

Resources

GGG Evaluation Team

Kathy Cassidy

STYLISTIC Q702

First impression on unpacking the Q702 test unit was the solid feel and clean, minimalist styling.

Anthony Grifoni

STYLISTIC Q572

For work use, Microsoft Word and Excel programs pre-installed on the device are adequate for preparing short documents.

Steph Mundell

LIFEBOOK UH574

The Fujitsu LifeBook UH574 allowed for great mobility without being obnoxiously heavy or clunky. Its twelve hours of battery life did not disappoint.

Andrew Mitsi

STYLISTIC Q702

The screen was particularly good. It is bright and visible from most angles, however heat is an issue, particularly around the Windows button on the front, and on the back where the battery housing is located.

Simon Harriott

STYLISTIC Q702

My first impression after unboxing the Q702 is that it is a nice looking unit. Styling is somewhat minimalist but very effective. The tablet part, once detached, has a nice weight, and no buttons or switches are located in awkward or intrusive positions.

Latest Jobs

Shopping.com

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?