PT-2006-6217 · Aol · Aol

Published 2006-10-25 · Updated 2017-07-20 · CVE-2006-5502

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions AOL versions 9.0 Security Edition

Description The issue is a heap-based buffer overflow in the AOL.PicDownloadCtrl.1 ActiveX control, specifically in the YGPPicDownload.dll version 9.2.3.0. This allows remote attackers to execute arbitrary code via the AddPictureNoAlbum method.

Recommendations For AOL version 9.0 Security Edition, consider disabling the AddPictureNoAlbum method as a temporary workaround until a patch is available.

Fix

Related Identifiers

CVE-2006-5502

Affected Products

Aol

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2006-5502 · Security Note
• http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=429 · Vendor Advisory
• http://securityfocus.com/bid/20747 · Note
• http://secunia.com/advisories/22567 · Note
• http://securitytracker.com/id?1017121 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/29795 · Note
• http://vupen.com/english/advisories/2006/4197 · Note