[Full-disclosure] Yahoo messenger file extension spoof vulnerability

[Ivan Ivan <ivancool2003@xxxxxxxxxxxx>]

Hi, i discover a possible file name extension spoofing in yahoo messenger 
8.0.0.863 (lastest),obviously this requires that the option "Hide extension for 
known file types" is enabled in Windows, you need to send a file with this name 
for example: Annakournikova and her 
friends.jpg????????????????????????????????????????.exe or 
Trojan.txt????????????????.exe Info.txt??????????????.exe The ? characters hide 
the extension.
                
---------------------------------
 Preguntá. Respondé. Descubrí.
 Todo lo que querías saber, y lo que ni imaginabas,
 está en Yahoo! Respuestas (Beta).
 Probalo ya!

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/