AOL YGPPDownload AddPictureNoAlbum ActiveX Controls Buffer Overflow Vulnerability
BID:20747
Info
AOL YGPPDownload AddPictureNoAlbum ActiveX Controls Buffer Overflow Vulnerability
| Bugtraq ID: | 20747 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2006-5502 |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 25 2006 12:00AM |
| Updated: | Jul 05 2007 09:17PM |
| Credit: | Dennis Rand is credited with discovering this issue. |
| Vulnerable: |
AOL AOL Security Edition 9.0 |
| Not Vulnerable: | |
Discussion
AOL YGPPDownload AddPictureNoAlbum ActiveX Controls Buffer Overflow Vulnerability
AOL YGPPDownload ActiveX control is prone to a heap-based buffer-overflow vulnerability.
A user can invoke the object from a malicious web page to trigger the condition. If the vulnerability is successfully exploited, this would result in a denial-of-service condition due to a runtime error in the affected module that crashes the running instance of the client application that the object is invoked through (typically Internet Explorer). An attacker may also be able to exploit the condition to corrupt process memory, resulting in arbitrary code execution in the context of the client application.
The AOL YGPPDownload ActiveX control is vulnerable to this issue.
AOL YGPPDownload ActiveX control is prone to a heap-based buffer-overflow vulnerability.
A user can invoke the object from a malicious web page to trigger the condition. If the vulnerability is successfully exploited, this would result in a denial-of-service condition due to a runtime error in the affected module that crashes the running instance of the client application that the object is invoked through (typically Internet Explorer). An attacker may also be able to exploit the condition to corrupt process memory, resulting in arbitrary code execution in the context of the client application.
The AOL YGPPDownload ActiveX control is vulnerable to this issue.
Exploit / POC
AOL YGPPDownload AddPictureNoAlbum ActiveX Controls Buffer Overflow Vulnerability
Currently we are not aware of any exploits for these issues. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Currently we are not aware of any exploits for these issues. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
AOL YGPPDownload AddPictureNoAlbum ActiveX Controls Buffer Overflow Vulnerability
Solution:
Fixes are available from the vendor through the AOL Client software's automatic update feature.
Solution:
Fixes are available from the vendor through the AOL Client software's automatic update feature.
References
AOL YGPPDownload AddPictureNoAlbum ActiveX Controls Buffer Overflow Vulnerability
References:
References: