AOL You've Got Pictures ActiveX Control Buffer Overflow Vulnerability
BID:16262
Info
AOL You've Got Pictures ActiveX Control Buffer Overflow Vulnerability
| Bugtraq ID: | 16262 |
| Class: | Boundary Condition Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 16 2006 12:00AM |
| Updated: | Jan 16 2006 12:00AM |
| Credit: | Richard M. Smith reported this issue to the vendor. |
| Vulnerable: |
AOL Client Software 9.0 AOL Client Software 8.0 + AOL Client Software 8.0 |
| Not Vulnerable: |
AOL Client Software 9.0 Security AOL Client Software 9.0 Optimized |
Discussion
AOL You've Got Pictures ActiveX Control Buffer Overflow Vulnerability
AOL You've Got Pictures ActiveX control is prone to a buffer overflow vulnerability.
It is possible to invoke the object from a malicious Web page to trigger the condition. If the vulnerability were successfully exploited, this would result in a denial of service due to a runtime error in the affected module that causes the running instance of the client application that the object is invoked through (typically Internet Explorer) to crash. It may also be possible to exploit the condition to corrupt process memory, resulting in arbitrary code execution. Arbitrary code would be executed in the context of the client application.
The affected ActiveX control was distributed in various versions of AOL Client Software, and on the You've Got Pictures Web site prior to 2004.
AOL You've Got Pictures ActiveX control is prone to a buffer overflow vulnerability.
It is possible to invoke the object from a malicious Web page to trigger the condition. If the vulnerability were successfully exploited, this would result in a denial of service due to a runtime error in the affected module that causes the running instance of the client application that the object is invoked through (typically Internet Explorer) to crash. It may also be possible to exploit the condition to corrupt process memory, resulting in arbitrary code execution. Arbitrary code would be executed in the context of the client application.
The affected ActiveX control was distributed in various versions of AOL Client Software, and on the You've Got Pictures Web site prior to 2004.
Exploit / POC
AOL You've Got Pictures ActiveX Control Buffer Overflow Vulnerability
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
AOL You've Got Pictures ActiveX Control Buffer Overflow Vulnerability
Solution:
Fixes are available from the vendor. The vendor has also made a tool that removes the affected ActiveX control from affected computers, as it is no longer needed for correct functionality of the service. The removal utility may be downloaded from:
http://download.newaol.com/security/YGPClean.exe
Solution:
Fixes are available from the vendor. The vendor has also made a tool that removes the affected ActiveX control from affected computers, as it is no longer needed for correct functionality of the service. The removal utility may be downloaded from:
http://download.newaol.com/security/YGPClean.exe
References
AOL You've Got Pictures ActiveX Control Buffer Overflow Vulnerability
References:
References: