[NT] AOL YGPPDownload AddPictureNoAlbum ActiveX Control Heap Corruption

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -



AOL YGPPDownload AddPictureNoAlbum ActiveX Control Heap Corruption
------------------------------------------------------------------------


SUMMARY

America Online 9.0 Security Edition builds "upon Internet Explorer
technology to offer its users enhanced security and usability features".
America Online 9.0 Security Edition ships with an ActiveX control which is
marked as safe for scripting and contains a buffer overflow vulnerability
which allows for the arbitrary execution of code.

DETAILS

Vulnerable Systems:
* AOL Security Edition 9.0 with downloader plugin version 9.2.3.0

When AOL 9.0 is installed, it registers the following ActiveX control on
the system:

ProgId: AOL.PicDownloadCtrl.1
ClassId: D670D0B3-05AB-4115-9F87-D983EF1AC747
File: YGPPicDownload.dll

This control is registered as safe for scripting in IE and contains a
buffer overflow in its AddPictureNoAlbum() method.

Solutions:
1. Users of AOL 9.0 or AOL 9.0 Security Edition are recommended to log in
to the AOL service and a fix will be seamlessly applied to their system.

2. Users using versions of AOL that are older than 9.0 are strongly
recommended to upgrade to the latest version of AOL 9.0 Security Edition."

Disclosure Timeline:
10/12/2006 - Initial vendor notification
10/23/2006 - Initial vendor response
10/25/2006 - Coordinated public disclosure


ADDITIONAL INFORMATION

The information has been provided by
<mailto:idlabs-advisories@xxxxxxxxxxxx> iDefense Labs Security Advisories.
The original article can be found at:
<http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=429>
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=429



========================================


This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@xxxxxxxxxxxxxx
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@xxxxxxxxxxxxxx


====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

Relevant Pages

  • Anyone up for a challenge?
    ... Internet connection. ... cracker is somehow using it or relying on it for something. ... A funny thing I saw today, was that when the MSIE security was set to ... the "can not find server" white page, while the internal AOL browser ...
    (comp.security.firewalls)
  • [NT] AOL Insecure Default Directory Permissions
    ... Get your security news from a reliable source. ... AOL Insecure Default Directory Permissions ... local users to manipulate arbitrary files. ... The vendor has issued an updated version. ...
    (Securiteam)
  • AOL Offers Total Care PC Protection
    ... AOL Offers Total Care PC Protection ... AOL is set to become the latest company to enter the security software ...
    (misc.consumers)
  • Re: AOL IE settings concern
    ... HEH they said AOL ... >users' Internet Explorer security settings. ... >"This in itself is a large security hazard, allowing a Web site to run ... "Since Internet Explorer ...
    (comp.security.firewalls)
  • Re: Your current security settings prohibit running active x contr
    ... I eventually got the Java download, I had to disable Norton Internet ... security 2002 to get the download....but still had the problem. ... AOL software. ...
    (microsoft.public.windows.inetexplorer.ie6.setup)