PT-2006-4739 · Aol · America Online

Will Dormann · Published 2006-10-10 · Updated 2017-07-20 · CVE-2006-3888

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions America Online version 9.0 Security Edition

Description A buffer overflow issue exists in the AOL You've Got Pictures (YGP) Pic Downloader YGPPDownload ActiveX control, which can be exploited by remote attackers to execute arbitrary code. This is achieved by passing a long argument to the SetAlbumName method.

Recommendations For America Online version 9.0 Security Edition, consider disabling the YGPPDownload ActiveX control until a patch is available. Restrict access to the SetAlbumName method to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2006-3888

Affected Products

America Online

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2006-3888 · Security Note
• http://secunia.com/advisories/22304 · Note
• http://vupen.com/english/advisories/2006/3967 · Note
• http://securityfocus.com/bid/20472 · Note
• http://kb.cert.org/vuls/id/MIMG-6MUUJ8 · Note
• http://securityfocus.com/bid/20425 · Note
• http://kb.cert.org/vuls/id/661524 · Note
• http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=420 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/29410 · Note
• http://securitytracker.com/id?1017024 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/29494 · Note