AOL You"ve Got Pictures ActiveX buffer overflow
| aol-youvegotpictures-activex-bo (24160) |  High Risk |
Description:
The AOL You've Got Pictures component in AOL is vulnerable to a buffer overflow in the AOL YGP Picture Finder Tool ActiveX control (YGPPicFinder.dll). By creating a malicious Web page that invokes the affected ActiveX control and persuading a user to visit the page, a remote attacker could overflow a buffer and cause the victim's Web browser to crash or execute arbitrary code on the victim's system.
Note: This vulnerability also affects the YGPPicFinder.dll ActiveX control that was distributed on the You've Got Pictures Web site prior to 2004.
Platforms Affected:
- AOL, AOL 8.0
- AOL, AOL 8.0 Plus
- AOL, AOL 9.0 Classic
Remedy:
Upgrade to AOL 9.0 Optimized or AOL 9.0 Security Edition.
--OR--
Apply the hotfix (YPGClean.exe) for this issue, available from the AOL Download Web site. See References.
Consequences:
Gain Access
References:
- AOL Dowload Web site, Index of /security at http://download.newaol.com/security/.
- AOL Web site, AOL.com - Welcome to America Online at http://www.aol.com/.
- BID-16262: AOL You've Got Pictures ActiveX Control Buffer Overflow Vulnerability
- CVE-2006-0316: Buffer overflow in YGPPicFinder.DLL in AOL You've Got Pictures (YGP) Picture Finder Tool ActiveX Control, as used in AOL 8.0, 8.0 Plus, and 9.0 Classic, allows remote attackers to execute arbitrary code via unspecified vectors.
- OSVDB ID: 22486: America OnLine (AOL) YPG Picture Finder Tool ActiveX Control (YGPPicFinder.DLL) Overflow
- SA18521: AOL You`ve Got Pictures ActiveX Control Buffer Overflow
- SECTRACK ID: 1015494: AOL Buffer Overflow in You`ve Got Pictures ActiveX Control Lets Remote Users Execute Arbitrary Code
- US-CERT VU#715730: AOL You`ve Got Pictures ActiveX control buffer overflow
- VUPEN/ADV-2006-0221: AOL YGP Picture Finder Tool ActiveX Control Buffer Overflow Vulnerability
Reported:
Jan 16, 2006
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net