CVE-2007-3147
EXPLOITEDYahoo! Messenger - Buffer Overflow in Webcam Upload ActiveX Control
Title source: llmExploitation Summary
CVE-2007-3147 has been observed exploited in the wild (reported by VulnCheck KEV).
EIP tracks 4 public exploits from researchers including Metasploit, Excepti0n, MC, including a Metasploit module exploits/windows/browser/yahoomessenger_server.
AI-analyzed exploit summary This Metasploit module exploits a stack buffer overflow in Yahoo! Messenger 8.1.0.249's ActiveX control (ywcupl.dll) via an overly long string to the 'Server()' method followed by a 'Send()' call. It delivers a payload to achieve remote code execution.
Description
Buffer overflow in the Yahoo! Webcam Upload ActiveX control in ywcupl.dll 2.0.1.4 for Yahoo! Messenger 8.1.0.249 allows remote attackers to execute arbitrary code via a long server property value to the send method. NOTE: some of these details are obtained from third party information.
Exploits (4)
This Metasploit module exploits a stack buffer overflow in Yahoo! Messenger 8.1.0.249's ActiveX control (ywcupl.dll) via an overly long string to the 'Server()' method followed by a 'Send()' call. It delivers a payload to achieve remote code execution.
This exploit targets a vulnerability in Yahoo's Ywcupl.dll ActiveX control (CVE-2007-3147) to achieve remote code execution. It generates an HTML file with malicious JavaScript that triggers a heap overflow, executing shellcode to download and run an arbitrary file from a specified URL.
This exploit targets a heap overflow vulnerability in the Symantec Norton AntiVirus ActiveX control (clsid:DCE2F8B1-A520-11D4-8FD0-00D0B7730277) by spraying the heap with NOP sleds and shellcode, then triggering the overflow via the 'server' property. The shellcode executes calc.exe as a proof of concept.
This Metasploit module exploits a stack buffer overflow in Yahoo! Messenger 8.1.0.249's ActiveX control (ywcupl.dll) via an overly long string to the 'Server()' method followed by a 'Send()' call. It achieves remote code execution by leveraging a crafted payload and return address.