medium5.0Public exploit code
CVE-2007-5017
Absolute path traversal vulnerability in a certain ActiveX control in the CYFT object in ft60.dll in Yahoo!
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Yahoo! Messenger 8.1.0.421 - CYFT Object Arbitrary File Download2007-09-19 · remote · windows · Verified
Impact
Absolute path traversal vulnerability in a certain ActiveX control in the CYFT object in ft60.dll in Yahoo! Messenger 8.1.0.421 allows remote attackers to force a download, and create or overwrite arbitrary files via a full pathname in the second argument to the GetFile method.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Yahoo | Messenger | Version 8.1.0.421 |
Weakness classification
References
- NVD record
- CVE.org record
- http://osvdb.org/38296
- http://www.securityfocus.com/bid/25727
- http://www.securitytracker.com/id?1018715
- http://www.shinnai.altervista.org/exploits/txt/TXT_KJDPaI2IlM5P9PP6N6dI.html
- https://exchange.xforce.ibmcloud.com/vulnerabilities/36694
- https://www.exploit-db.com/exploits/4428
- http://osvdb.org/38296
- http://www.securityfocus.com/bid/25727
- http://www.securitytracker.com/id?1018715
- http://www.shinnai.altervista.org/exploits/txt/TXT_KJDPaI2IlM5P9PP6N6dI.html
- https://exchange.xforce.ibmcloud.com/vulnerabilities/36694
- https://www.exploit-db.com/exploits/4428