The following security advisory is sent to the securiteam mailing list, and can
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
AOL YGPPDownload downloadFileDirectory ActiveX Control Heap Corruption
------------------------------------------------------------------------
SUMMARY
America Online 9.0 Security Edition builds "upon Internet Explorer
technology to offer its users enhanced security and usability features".
America Online 9.0 Security Edition ships with an ActiveX control which is
marked as safe for scripting and contains a buffer overflow vulnerability
which allows for the arbitrary execution of code.
DETAILS
Vulnerable Systems:
* AOL Security Edition 9.0 with downloader plugin version 9.2.3.0
When AOL 9.0 is installed, it registers the following ActiveX control on
the system:
ProgId: AOL.PicDownloadCtrl.1
ClassId: D670D0B3-05AB-4115-9F87-D983EF1AC747
File: YGPPicDownload.dll
This control is registered as safe for scripting in IE and contains a
buffer overflow in its downloadFileDirectory property.
Workaround:
Disabling Active Scripting or unregistering the vulnerable control can
prevent exploitation.
Solutions:
1. Users of AOL 9.0 or AOL 9.0 Security Edition are recommended to log in
to the AOL service and a fix will be seamlessly applied to their system.
2. Users using versions of AOL that are older than 9.0 are strongly
recommended to upgrade to the latest version of AOL 9.0 Security Edition."
Disclosure Timeline:
10/12/2006 - Initial vendor notification
10/23/2006 - Initial vendor response
10/25/2006 - Coordinated public disclosure
ADDITIONAL INFORMATION
The information has been provided by
<mailto:idlabs-advisories@idefense.com> iDefense Labs Security Advisories.
The original article can be found at:
<http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=430>
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=430
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to:
list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to:
list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any
kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.
