Yahoo Messenger hit with ninth zero-day exploit of the year
The latest exploit on the Web can force-feed a malicious file to IM users
Computerworld - Attack code that targets Yahoo Messenger has been published on the Internet, a security researcher warned today, marking the ninth exploit aimed at the popular instant messaging software so far this year.
In a posting to the milw0rm.com Web site, someone identified as "shinnai" disclosed malicious Visual Basic code that allegedly lets attackers feed any file to users of the latest version of Messenger. The exploit code successfully executes on a fully-patched PC running Windows XP SP2, shinnai said, although the effect depends on the security settings of Internet Explorer (IE).
According to an e-mail alert from nCircle Network Security Inc., hackers armed with the exploit could force-feed malware such as a Trojan horse to vulnerable users. It was nCircle that pegged the latest zero-day threat against Messenger as No. 9 for the year.
IE's security, however, can mitigate an attack. Users running the newer IE 7 with default security settings will probably be protected.
"This latest exploit is another data point in the strong trend toward IM client attacks," said Andrew Storms, nCircle's director of security operations. "IM vendors jockeying for market share are trying to lure new users with new features that also open up new risks to end users."
Storms was referring to the rash of instant messaging program flaws that have been uncovered in recent months. Yahoo Messenger, for example, has been patched several times this summer, while Microsoft Corp. decided less than a week ago on a mandatory upgrade that meant all users of its MSN Messenger and Windows Live Messenger clients had to update or lose access to the service.
Storms recommended that corporate IT admit that unauthorized instant messaging software is being used on their networks. "Enterprise IT teams that have been ignoring IM clients because they are not part of the 'official' infrastructure would be well advised to take steps to bring an IM client onto their supported platform and make sure their antivirus and spyware vendors work with their selected client," he said in an e-mail.
Yahoo Inc., which patched Messenger twice last month, did not immediately respond to a request for confirmation of the newest flaw and queries about a patch timeline.
Read more about Security in Computerworld's Security Topic Center.
- 15 Non-Certified IT Skills Growing in Demand
- How 19 Tech Titans Target Healthcare
- Twitter Suffering From Growing Pains (and Facebook Comparisons)
- Agile Comes to Data Integration
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- The 12 PCI DSS 3.0 requirements addressed by Peer 1 Hosting This handy quick reference outlines the 12 PCI DSS 3.0 requirements, who needs to be compliant and how Alert Logic solutions address the...
- Defense Throughout the Vulnerability Life Cycle This whitepaper provides insight into how to leverage threat and log management technologies to protect your IT assets throughout their vulnerability life cycle.
- Mobile Policy Checklist Here's what to consider when putting together a mobile policy designed to support a highly productive workforce.
- Securing BYOD Mobile computing is becoming so ubiquitous that people no longer bat an eye seeing someone working two devices simultaneously. Individuals and organizations are...
- Live Webcast On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy...
- Live Webcast Endpoint Backup & Restore: Protect Everyone, Everywhere Arek Sokol from the bleeding-edge IT team at Genentech/Roche explains how he leverages cross-platform enterprise endpoint backup in the public cloud as part...
- Streamline Software Asset Management, Compose a software Management Symphony Keeping track of your organization's software is easy with effective software management solutions from CDW. View the videos in our software solutions channel
- Druva inSync: Endpoint Data Protection & Governance CLICK HERE to watch this video about protecting corporate data on laptops and mobile devices, sponsored by Druva. All Security White Papers | Webcasts