Yahoo! Music Jukebox 'datagrid.dll' ActiveX Control Remote Buffer Overflow Vulnerability
BID:27579
Info
Yahoo! Music Jukebox 'datagrid.dll' ActiveX Control Remote Buffer Overflow Vulnerability
| Bugtraq ID: | 27579 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2008-0624 |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 02 2008 12:00AM |
| Updated: | May 07 2015 05:33PM |
| Credit: | Krystian Kloskowski and Elazar are credited with the discovery of this vulnerability. |
| Vulnerable: |
Yahoo! Music Jukebox 2.2 |
| Not Vulnerable: |
Yahoo! Music Jukebox 2.2.2.058 |
Discussion
Yahoo! Music Jukebox 'datagrid.dll' ActiveX Control Remote Buffer Overflow Vulnerability
Yahoo! Music Jukebox 'datagrid.dll' ActiveX control is prone to a buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied input.
An attacker can exploit this issue to execute arbitrary code in the context of an application using the ActiveX control (typically Internet Explorer). Failed attacks will likely cause denial-of-service conditions.
This issue affects 'datagrid.dll' 2.2.2.56; other versions may also be vulnerable.
Yahoo! Music Jukebox 'datagrid.dll' ActiveX control is prone to a buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied input.
An attacker can exploit this issue to execute arbitrary code in the context of an application using the ActiveX control (typically Internet Explorer). Failed attacks will likely cause denial-of-service conditions.
This issue affects 'datagrid.dll' 2.2.2.56; other versions may also be vulnerable.
Exploit / POC
Yahoo! Music Jukebox 'datagrid.dll' ActiveX Control Remote Buffer Overflow Vulnerability
Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.
The following exploit is available:
Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.
The following exploit is available:
Solution / Fix
Yahoo! Music Jukebox 'datagrid.dll' ActiveX Control Remote Buffer Overflow Vulnerability
Solution:
The vendor released an update to address this issue. Please see the references for more information.
Yahoo! Music Jukebox 2.2
Solution:
The vendor released an update to address this issue. Please see the references for more information.
Yahoo! Music Jukebox 2.2
References
Yahoo! Music Jukebox 'datagrid.dll' ActiveX Control Remote Buffer Overflow Vulnerability
References:
References:
- Microsoft Knowledge Base Article 240797 (Microsoft)
- Yahoo! Music Jukebox (Yahoo!)
- Microsoft Security Bulletin MS08-023 - Critical (Microsoft)
- Vulnerability Note VU#101676 Yahoo! Music Jukebox YMP Datagrid ActiveX control s (US-CERT)
- Yahoo! Music Jukebox Security Update (Yahoo!)