AOL You've Got Pictures ActiveX Controls Buffer Overflow Vulnerabilities
BID:20425
Info
AOL You've Got Pictures ActiveX Controls Buffer Overflow Vulnerabilities
| Bugtraq ID: | 20425 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2006-3888 CVE-2006-3887 |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 10 2006 12:00AM |
| Updated: | Oct 11 2006 07:24PM |
| Credit: | Will Dormann of CERT/CC reported these issues to the vendor. |
| Vulnerable: |
AOL Client Software 9.0 AOL Client Software 8.0 + AOL Client Software 8.0 |
| Not Vulnerable: | |
Discussion
AOL You've Got Pictures ActiveX Controls Buffer Overflow Vulnerabilities
AOL You've Got Pictures (YGP) ActiveX controls are prone to multiple buffer-overflow vulnerabilities.
A user can invoke the object from a malicious web page to trigger the condition. If the vulnerabilities are successfully exploited, this would result in a denial-of-service condition due to a runtime error in the affected module that crashes the running instance of the client application that the object is invoked through (typically Internet Explorer). An attacker may also be able to exploit the condition to corrupt process memory, resulting in arbitrary code execution. Arbitrary code would be executed in the context of the client application.
YGP ScreenSaver and YGP Pic Downloader ActiveX controls are vulnerable to these issues.
AOL You've Got Pictures (YGP) ActiveX controls are prone to multiple buffer-overflow vulnerabilities.
A user can invoke the object from a malicious web page to trigger the condition. If the vulnerabilities are successfully exploited, this would result in a denial-of-service condition due to a runtime error in the affected module that crashes the running instance of the client application that the object is invoked through (typically Internet Explorer). An attacker may also be able to exploit the condition to corrupt process memory, resulting in arbitrary code execution. Arbitrary code would be executed in the context of the client application.
YGP ScreenSaver and YGP Pic Downloader ActiveX controls are vulnerable to these issues.
Exploit / POC
AOL You've Got Pictures ActiveX Controls Buffer Overflow Vulnerabilities
Currently we are not aware of any exploits for these issues. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Currently we are not aware of any exploits for these issues. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
AOL You've Got Pictures ActiveX Controls Buffer Overflow Vulnerabilities
Solution:
Fixes are available from the vendor through the AOL Client software's automatic update feature.
Solution:
Fixes are available from the vendor through the AOL Client software's automatic update feature.
References
AOL You've Got Pictures ActiveX Controls Buffer Overflow Vulnerabilities
References:
References:
- America Online, Inc. Information for VU#154641 (US-CERT)
- America Online, Inc. Information for VU#661524 (US-CERT)
- AOL Home Page (AOL)
- Vulnerability Note VU#154641 (US-CERT)
- Vulnerability Note VU#661524 (US-CERT)