With Attack Code Out, Yahoo Fixes IM Flaw

Yahoo fixes a serious vulnerability in its Messenger instant messaging client.

Yahoo Inc. has fixed a serious vulnerability in its Messenger instant messaging client.

The patch, posted Thursday fixes a critical flaw in the ActiveX control used by Messenger's Webcam feature. According to security experts, this flaw could be exploited by hackers to install unauthorized software on a victim's PC.

The patch came after two sample attacks that exploited the vulnerability were posted to the Full Disclosure security discussion list.

EEye Digital Security Inc. first reported the issue on Wednesday, without disclosing specific details of the bug.

The security vendor considers the flaw to be serious. "ActiveX remote code execution vulnerabilities have very high impacts since the source of the malicious payload can be any site on the Internet," eEye said in its alert.

This is the third time in recent months that Yahoo has had to patch an ActiveX control flaw in Messenger. It patched these other bugs in March and December.

Related Links:

• Go back to category Internet & Networks to read more reviews and articles.
• Go back to Software Magazine's main page.