Friday, 17 August 2007

Keepoff From Yahoo Messenger Webcam Invites

Security company McAfee has asked users of Yahoo instant messenger to keep from webcam invites from unknown sources after a vulnerability in the platform was discovered...

Security company McAfee has asked users of Yahoo instant messenger to keep from webcam invites from unknown sources after a vulnerability in the platform was discovered.

The zero-day flaw was first published on Chinese security forums, but researchers at McAfee said this week that they recreated the flaw on Yahoo Messenger version 8.1.0.413.

The vulnerability "seems like a classic heap overflow that can be triggered when the victim accepts a webcam invite," Wei Wang, a researcher at McAfee Avert Labs said.

McAfee said it notified Yahoo’s security team about the issue, and advised users to decline webcam invites from untrusted sources and block outgoing traffic on TCP port 5100 until Yahoo fixes the vulnerability.