Short Name |
CHAT:YIM:LONG-FILE-NAME |
---|---|
Severity |
High |
Recommended |
No |
Category |
CHAT |
Keywords |
E5D12C4E-7B4F-11D3-B5C9-0050045C3C96 |
Release Date |
2008/01/30 |
Update Number |
1213 |
Supported Platforms |
idp-4.0+, isg-3.0+, j-series-9.5+, mx-11.4+, srx-12.1+, srx-branch-12.1+, vsrx-12.1+ |
This signature detects attempts to exploit a known vulnerability in Yahoo Instant Messenger's file transfer method. An attacker can submit a file with an overly long file name, which masks the file extension. This could fool users into downloading malicious content without their knowledge.
A remote download dialogue box spoofing vulnerability affects Yahoo! Messenger. This issue is due to a design error that facilitates the spoofing of file names. An attacker may leverage this issue to spoof downloaded file names to unsuspecting users. This issue may lead to a compromise of the target computer as well as other consequences. It should be noted that although only Yahoo! Messenger version 6.0.0.1750 is reportedly affected; earlier versions may be affected as well.