Yahoo! Music Jukebox AddImage Function ActiveX Remote Buffer Overflow Vulnerability
BID:27590
Info
Yahoo! Music Jukebox AddImage Function ActiveX Remote Buffer Overflow Vulnerability
| Bugtraq ID: | 27590 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2008-0623 |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 04 2008 12:00AM |
| Updated: | May 07 2015 05:33PM |
| Credit: | Krystian Kloskowski discovered this vulnerability. |
| Vulnerable: |
Yahoo! Music Jukebox 2.2 |
| Not Vulnerable: |
Yahoo! Music Jukebox 2.2.2.058 |
Discussion
Yahoo! Music Jukebox AddImage Function ActiveX Remote Buffer Overflow Vulnerability
Yahoo! Music Jukebox 'datagrid.dll' ActiveX control is prone to a buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied input.
An attacker can exploit this issue to execute arbitrary code in the context of an application using the ActiveX control (typically Internet Explorer). Failed attacks will likely cause denial-of-service conditions.
This issue affects 'datagrid.dll' 2.2.2.56; other versions may also be vulnerable.
Yahoo! Music Jukebox 'datagrid.dll' ActiveX control is prone to a buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied input.
An attacker can exploit this issue to execute arbitrary code in the context of an application using the ActiveX control (typically Internet Explorer). Failed attacks will likely cause denial-of-service conditions.
This issue affects 'datagrid.dll' 2.2.2.56; other versions may also be vulnerable.
Exploit / POC
Yahoo! Music Jukebox AddImage Function ActiveX Remote Buffer Overflow Vulnerability
This issue is being actively exploited in the wild.
The following exploits are available:
This issue is being actively exploited in the wild.
The following exploits are available:
Solution / Fix
Yahoo! Music Jukebox AddImage Function ActiveX Remote Buffer Overflow Vulnerability
Solution:
The vendor released an update to address this issue. Please see the references for more information.
Yahoo! Music Jukebox 2.2
Solution:
The vendor released an update to address this issue. Please see the references for more information.
Yahoo! Music Jukebox 2.2
References
Yahoo! Music Jukebox AddImage Function ActiveX Remote Buffer Overflow Vulnerability
References:
References:
- Microsoft Knowledge Base Article 240797 (Microsoft)
- Yahoo! Music Jukebox (Yahoo!)
- Microsoft Security Bulletin MS08-023 - Critical (Microsoft)
- Vulnerability Note VU#101676 Yahoo! Music Jukebox YMP Datagrid ActiveX control s (US-CERT)
- Yahoo! Music Jukebox Security Update (Yahoo!)