Buffer Overflow in Yahoo! Messenger Webcam Upload Control
CVE-2007-3147

Currently unrated

Key Information:

Vendor

Yahoo

Status
Messenger
Vendor
CVE Published:
11 June 2007

Badges

👾 Exploit Exists🟡 Public PoC🟣 EPSS 40%

What is CVE-2007-3147?

A buffer overflow vulnerability exists in the Yahoo! Webcam Upload ActiveX control (ywcupl.dll version 2.0.1.4) that affects Yahoo! Messenger 8.1.0.249. This flaw allows remote attackers to exploit the vulnerability by sending a specially crafted long server property value to the 'send' method, potentially enabling them to execute arbitrary code on the affected machine. Users of affected versions are advised to take precautions to mitigate exposure to this vulnerability.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2007-3147 - Proof of Concept

References

http://lists.grok.org.uk/pipermail/full-disclosure/2007-J...
mailing-listx_refsource_FULLDISC
https://www.exploit-db.com/exploits/4042
exploitx_refsource_EXPLOIT-DB
http://www.securityfocus.com/bid/24354
vdb-entryx_refsource_BID

EPSS Score

40% chance of being exploited in the next 30 days.

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.