PT-2008-1660 · Aol · Aol You'Ve Got Pictures

Publicado 2008-02-04 · Atualizado 2008-11-15 · CVE-2007-6699

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions AOL You've Got Pictures (YGP) Picture Editor version 9.5.1.8

Description The issue concerns multiple buffer overflows in the AIM PicEditor ActiveX control. These overflows can be triggered by a long string in various property values, including DisplayName, FinalSavePath, ForceSaveTo, HiddenControls, InitialEditorScreen, Locale, Proxy, and UserAgent. This can cause a denial of service, resulting in a browser crash.

Recommendations For version 9.5.1.8, consider restricting the input length for the DisplayName, FinalSavePath, ForceSaveTo, HiddenControls, InitialEditorScreen, Locale, Proxy, and UserAgent properties to prevent buffer overflows. As a temporary workaround, avoid using long strings in these property values until a patch is available.

Exploit

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2007-6699

Produtos afetados

Aol You'Ve Got Pictures

Referências · 7

• 🔥 http://securityfocus.com/bid/27026 · Exploit
• 🔥 http://seclists.org/fulldisclosure/2007/Dec/0561.html · Exploit
• 🔥 https://exploit-db.com/exploits/30936 · Exploit
• http://osvdb.org/41198 · Nota
• http://seclists.org/fulldisclosure/2007/Dec/0574.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-6699 · Nota de Segurança
• http://securitytracker.com/id?1019143 · Nota