Check Point Advisories

Yahoo! Messenger File Transfer Filename Spoofing (CVE-2005-0243)

Check Point Reference: CPAI-2005-195
Date Published: 10 Dec 2009
Severity: Medium
Last Updated: Thursday 10 December, 2009
Source:
Industry Reference:CVE-2005-0243
Protection Provided by:

Security Gateway
R81, R80, R77, R75
Who is Vulnerable?
Vulnerability Description Yahoo Messenger is a service providing instant messages, similar to MSN Messenger and ICQ. Yahoo! Messenger allows users to see when their friends come online, send instant messages, join chat rooms, and exchange files. There exists a vulnerability in the way Yahoo! Messenger displays file names in the file transfer dialog. The product displays only a portion of an overly long filename. An attacker can exploit this flaw to mislead a user into downloading a malicious executable program. For example, from the truncated filename, a user may believe that he is receiving an image when in fact it is a program. Upon triggering the vulnerability, there is no change of behavior on the target. The file is downloaded to the target system. If the file is an executable program and the user opens the file, the program will then execute with the privileges of the currently logged in user. The behavior of the system is then dependent on the nature of the downloaded program.

Protection Overview

This protection will detect and block attempts to exploit this vulnerability

In order for the protection to be activated, update your Security Gateway product to the latest IPS update. For information on how to update IPS, go to SBP-2006-05, click on Protection tab and select the version of your choice.

Security Gateway R80 / R77 / R75

  1. In the IPS tab, click Protections and find the Yahoo! Messenger File Transfer Filename Spoofing protection using the Search tool and Edit the protection's settings.
  2. Install policy on all Security Gateways.

This protection's log will contain the following information:

Attack Name:  Instant Messenger.
Attack Information:  Yahoo! Messenger file transfer filename spoofing

×
  Feedback
This website uses cookies for its functionality and for analytics and marketing purposes. By continuing to use this website, you agree to the use of cookies. For more information, please read our Cookies Notice.
OK