Yahoo patches Messenger zero-day flaws

Yahoo Inc. on june 7th released a new version of its Messenger instant messaging client to patch a pair of zero-day vulnerabilities that let attackers grab control of a Windows PC with little or no help from the user. The bugs in Messenger's Webcam ActiveX controls were reported Wednesday by eEye Digital Security Inc.; within hours a researcher identified only as "Danny" had posted exploit code for both flaws on a security mailing list. A day later, Yahoo had patched Messenger, posted the new version on its site and urged everyone to download and install it. The update isn't mandatory, however. "Over the next several weeks, users worldwide will be prompted to update to a new version of Messenger upon signing into the service," a company spokesman said in an e-mail. "If you choose not to update, the vulnerability will still exist." Nor is the update automatic, which means that users with older versions of Yahoo Messenger installed, but who no longer use the IM client, may never receive the warning. Infrequent users of Messenger will also be at risk until they update Yahoo's software. A Yahoo security advisory also said that attacks would most likely come via malicious Web sites. "Some impacts of [the vulnerabilities] might include the introduction of executable code, being involuntarily logged out of a chat and/or instant messaging session, and the crash of an application such as Internet Explorer." Because Yahoo had posted the patched edition, eEye updated its advisory today with additional information on the vulnerabilities and how they could be exploited by attackers. Normally, said eEye, the two buggy ActiveX controls are used only when viewing or streaming webcam video content to and from Messenger. "But they are incorrectly marked safe for scripting and [so] can be instantiated by any Web site," eEye's new advisory read. That means an attacker with a malicious site can entice users there, then call on the flawed ActiveX controls without firing up Messenger and triggering the update alert. Also today, Danny the researcher updated his exploit code after others said they were unable to duplicate the vulnerabilities. Those testers have reported that the exploit updates work. According to eEye, all versions of Windows are vulnerable to attack, except for Vista, since Yahoo has not yet finished a version for that operating system. The updated Messenger for Windows 98, 2000, Millennium and XP is available for download.

Beware of fake Microsoft security alerts

With Microsoft Corp.'s monthly patch release expected on Tuesday, scammers are sending out fake security bulletins that attempt to install malicious software on victim's computers. The e-mail messages claim to describe a "Cumulative Security Update for Internet Explorer" that fixes a critical security flaw in the browser. It comes with a link entitled "Download this update." When users click on the link, they are taken to a server that attempts to install malicious software known as Trojan-Downloader.Win32.Agent.avk. This Trojan software then attempts to reach out to other computers on the Internet in order to install more programs on the victim's computer. The SANS Internet Storm Center received its first and only report of the scam on Thursday night but a second sample has also been posted to the Chinese Internet Security Response Team blog. SANS volunteer Lenny Zeltser believes that the criminals behind this scam may be gearing up for more activity. The trojan looks for three different servers; two of those have domains that haven't yet been registered. He suspects the authors of the scam may be planning to register those domains before embarking on a more widespread campaign. The two e-mail samples contained obvious errors that would be caught by technically savvy users. For example, although the patch Zeltser examined claimed to have been issued in June 2007, it was entitled MS06-4 instead of the more-plausible MS07-004. Still, these scams need to fool only a small percentage of victims in order to be successful, said Zeltser, information security practice leader at Gemini Systems LLC in New York. "You wonder, does it really matter that there are these strange discrepancies in the way the fake security alert is written," he said. "People who would notice probably would be the kind of people who wouldn't click on the link." Another tip-off: Microsoft does send out notification e-mail when it publishes security bulletins, but the links in these alerts take users to the bulletins themselves, not to executable downloads.