Menu
Critical IM bugs identified on Yahoo, Trillian

Critical IM bugs identified on Yahoo, Trillian

Security researchers have disclosed critical vulnerabilities in two popular Windows instant messaging clients, Yahoo Messenger and Trillian.

The Yahoo Messenger bug, which was posted to the Full Disclosure mailing list by Rajesh Sethumadhavan, is a buffer overflow flaw that can be exploited with a specially crafted address book entry. Messenger immediately crashes when it encounters the malformed entry, said Sethumadhavan, but it may also be susceptible to code execution, meaning an attacker might be able to inject his own malicious code — a keystroke stealer or a spam bot, for instance — into a compromised PC.

Yahoo has not posted a patch for the vulnerability; the company did not immediately respond to a request for confirmation and comment.

Trillian, a multiservice client, also sports two bad bugs, said other researchers.

A trio made up of Nate Mcfeters, Billy "BK" Rios and Raghav "The Pope" Dube identified two vulnerabilities in Trillian's handling of the AIM URI (uniform resource identifier). According to Mcfeters, Rios and Dube, the Trillian flaws are similar to the Internet Explorer/Firefox vulnerability that raised a ruckus last week.

"The first example shows the dangers of passing unfiltered arguments to programs that have registered URIs (much like the firefoxurl: vulnerability)," the three wrote in their advisory. "The second example shows that even if arguments are sanitized [emphasis in original] by the browser, many programs can be remotely pwnd via registered URIs and poor development practices."

US-CERT posted its own warning Monday as well. The bugs have been confirmed in Trillian 3.1.6.0, added Copenhagen-based vulnerability tracker Secunia APS, which pegged the problems as "highly critical," its second-most dire rating.

The Web site of Trillian developer Cerulean Studios did not offer an indication that a patch for the Trillian flaw would be forthcoming.


Follow Us

Join the newsletter!

Or
Error: Please check your email address.

Tags Yahootrillian

Featured

Slideshows

Bumper channel crowd kicks off first After Hours of 2018

Bumper channel crowd kicks off first After Hours of 2018

After Hours made a welcome return to the channel social calendar with a bumper crowd of partners, distributors and vendors descending on The Jefferson in Auckland to kick-start 2018. Photos by Gino Demeer.

Bumper channel crowd kicks off first After Hours of 2018
Looking back at the top 15 M&A deals in NZ during 2017

Looking back at the top 15 M&A deals in NZ during 2017

In 2017, merger and acquisitions fever reached new heights in New Zealand, with a host of big name deals dominating the headlines. Reseller News recaps the most important transactions of the Kiwi channel during the past 12 months.

Looking back at the top 15 M&A deals in NZ during 2017
Kiwi channel closes 2017 with After Hours

Kiwi channel closes 2017 with After Hours

The channel in New Zealand came together to celebrate the close of 2017, as the final After Hours played out in front of a bumper Auckland crowd.

Kiwi channel closes 2017 with After Hours
Show Comments