PT-2005-3487 · Aol · Aol Client

Published 2005-08-17 · Updated 2017-07-11 · CVE-2005-2597

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions AOL Client Software version 9.0

Description The issue allows local users to execute arbitrary code with SYSTEM privileges by replacing ACSD.exe with a malicious program due to insecure permissions for its installation path.

Recommendations For AOL Client Software version 9.0, consider restricting access to the installation path to prevent local users from replacing ACSD.exe with a malicious program. As a temporary workaround, monitor the installation directory for any unauthorized changes to the ACSD.exe file until a fix is available.

Fix

Related Identifiers

CVE-2005-2597

Affected Products

Aol Client

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2005-2597 · Security Note
• http://archives.neohapsis.com/archives/ntbugtraq/2005-08/0009.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24324 · Note
• http://securityfocus.com/bid/14530 · Note