AOL 9.5 'waol.exe' vCard ('.vcf') File Heap Buffer Overflow Vulnerability

Bugtraq ID:	38074
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Feb 03 2010 12:00AM
Updated:	Feb 03 2010 12:00AM
Credit:	Celil 'karak0rsan' Unuver and murderkey, Hellcode Research
Vulnerable:	AOL AOL 9.5
Not Vulnerable:

AOL 9.5 'waol.exe' vCard ('.vcf') File Heap Buffer Overflow Vulnerability

AOL 9.5 is prone to a heap-based buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied input.

Successful exploits may allow remote attackers to execute arbitrary code in the context of the application. Failed exploit attempts will cause denial-of-service conditions.

AOL 9.5 'waol.exe' vCard ('.vcf') File Heap Buffer Overflow Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

AOL 9.5 'waol.exe' vCard ('.vcf') File Heap Buffer Overflow Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

AOL 9.5 'waol.exe' vCard ('.vcf') File Heap Buffer Overflow Vulnerability

References:

• [Hellcode Research]: AOL 9.5 File Parsing Buffer Overflow Vulnerability (Hellcode Research)
  
• AOL Homepage (AOL)
  
• [Hellcode Research]: AOL 9.5 File Parsing Buffer Overflow Vulnerability ([email protected])