PT-2008-2248 · Yahoo · Yahoo! Music Jukebox

Krystian Kloskowski · Publicado 2008-02-06 · Atualizado 2017-09-29 · CVE-2008-0623

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Yahoo! Music Jukebox version 2.2.2.056

Description The issue is a stack-based buffer overflow in the YMP Datagrid ActiveX control, specifically in the datagrid.dll component. This occurs when a long argument is passed to the AddImage method, allowing remote attackers to execute arbitrary code.

Recommendations For Yahoo! Music Jukebox version 2.2.2.056, consider disabling the AddImage method in the YMP Datagrid ActiveX control as a temporary workaround until a patch is available.

Exploit

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2008-0623

Produtos afetados

Yahoo! Music Jukebox

Referências · 10

• 🔥 https://exploit-db.com/exploits/5051 · Exploit
• 🔥 http://securityfocus.com/bid/27590 · Exploit
• 🔥 https://exploit-db.com/exploits/5043 · Exploit
• 🔥 https://exploit-db.com/exploits/5048 · Exploit
• 🔥 https://exploit-db.com/exploits/5046 · Exploit
• http://vupen.com/english/advisories/2008/0396/references · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-0623 · Nota de Segurança
• http://securitytracker.com/id?1019301 · Nota
• http://kb.cert.org/vuls/id/101676 · Nota
• http://secunia.com/advisories/28757 · Nota