Vulnerability Note VU#393195

Yahoo! Messenger allows arbitrary users to be added to buddy list without proper authorization

Overview

Yahoo! Messenger is an instant messaging client. There is a vulnerability in Yahoo! Messenger that permits a remote user to add arbitrary users to the victim's buddy list.

I. Description

Yahoo! Messenger allows users to view content only from users on their buddy list. An attacker could craft a message to exploit this vulnerability and add arbitrary users to the victim's buddy list. This message would have to be sent through Yahoo! servers, and could not be exploited peer-to-peer.

II. Impact

A remote user may be able to add users to the victim's buddy list. This can create a vector of attack for other vulnerabilities that require the victim to accept content from the attacker.

III. Solution

This vulnerability was fixed by a sever-side resolution in February 2002. No user action is required.

Systems Affected

Vendor	Status	Date Notified	Date Updated
Yahoo	Vulnerable	5-Jun-2002

References

http://online.securityfocus.com/archive/1/257584

Credit

This vulnerablity was discovered by Scott Woodward <scott@phoenixtechie.com>.

This document was written by Jason Rafail.

Other Information

Date Public:	2002-02-21
Date First Published:	2002-06-05
Date Last Updated:	2002-06-10
CERT Advisory:	CA-2002-16
CVE-ID(s):
NVD-ID(s):
US-CERT Technical Alerts:
Metric:	15.19
Document Revision:	16

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Get Adobe Reader