COMMAND

    Yahoo! Messenger (build 733)

SYSTEMS AFFECTED

    Windows 95/98

PROBLEM

    Following  is  based  on  Team  Asylum  Security Advisory.  Yahoo!
    Messenger is a multi-functional online IM client which offers  not
    only  instant   messaging,  but   also  content-driven    features
    integrated into Yahoo!'s vast amount of information services  such
    as stock market updates, e-mail, and news.

    A  denial  of  service  attack  exists  in  build  733  of  Yahoo!
    Messenger.   The vulnerability  exists when  Messenger leaves port
    5010 open.   When a  connection is  made on  port 5010,  Messenger
    crashes.   The connection  stays open  until the  user closes  the
    program.   Malicious  users  can  not  only crash Yahoo! Messenger
    users,  but  it  also  gives  them  the capability of scanning and
    detecting Messenger users across wide networks by simply  scanning
    port 5010.

SOLUTION

    Team Asylum has notified Yahoo! and they have released build  734.
    Yahoo! Messenger  (Build 734)  still has  port 5010  open but will
    not crash if connections are made unto it.

    Alan T. Ruiz resported seeing the same problem in build 734!?