Yahoo! 0-day! exploit! hijacks! status! updates!

Point of Clarification

When i read this article my first thought was:

"Duh, don't accept file transfers from people you don't know"

When you actually read the MalwareCity blog that the article points to it clarifies that the exploit is actually injected into and run from the file transfer accept/deny dialog, so once you've got the request you're already 'sploited.

The el reg article says they're trying to send a file that's actually an iframe, but actually that iframe is already automatically sent and run.

The Bottomline action of denying off-list messages is still the same, but i think it's an important point of clarification.

face

This particular issue allows an iframe to be injected into an instant message. The iframe is then executing JS that is accessible in the IM (which looks something like a pastebin by the name of edKmYV3h). If you look very closely this issue with the JS (and by extension of messenger's functionality, outside-of-IM controls) becomes much more concerning. Currently, although unmentioned, this allows someone to execute scripts on a victim to send unsolicted instant messages and other packets from the victim, close the client, possibly set or read messenger preferences.

All said and done, Messenger is a prime candidate for a botnet until this is patched.