NOW READ THIS
("Security Advisory")
Submitted by: Bill Hickey
NCVA List Master
NRT-0405 Yahoo's Music Player Flaw:
The researcher who last week revealed vulnerabilities in the photo uploader used by
Facebook and MySpace said that multiple flaws in Yahoo's music player program could be
used to attack Windows PCs running Internet Explorer. He outlined a new bug in Yahoo
Music Jukebox and provided attack code for that flaw and another disclosed earlier by a
different researcher. The two ActiveX controls that can put systems at risk --
"datagrid.dll" and "mediagrid.dll" -- are both prone to buffer-overflow attacks because
they fail to account for malicious input. He posted proof-of-concepts for both bugs on
the milw0rm.com web site. He credited another researcher with uncovering the datagrid.dll
ActiveX vulnerability. Symantec Corporation confirmed the vulnerabilities and the
efficacy of the attack code, and also said that it is likely that in-the-wild exploits
will appear. Yahoo did not respond to questions about when and how the ActiveX controls
would be patched.
(ComputerWorld 04FEB08)