PT-2008-1660 · Aol · Aol You'Ve Got Pictures

Published 2008-02-04 · Updated 2008-11-15 · CVE-2007-6699

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions AOL You've Got Pictures (YGP) Picture Editor version 9.5.1.8

Description The issue concerns multiple buffer overflows in the AIM PicEditor ActiveX control. These overflows can be triggered by a long string in various property values, including DisplayName, FinalSavePath, ForceSaveTo, HiddenControls, InitialEditorScreen, Locale, Proxy, and UserAgent. This can cause a denial of service, resulting in a browser crash.

Recommendations For version 9.5.1.8, consider restricting the input length for the DisplayName, FinalSavePath, ForceSaveTo, HiddenControls, InitialEditorScreen, Locale, Proxy, and UserAgent properties to prevent buffer overflows. As a temporary workaround, avoid using long strings in these property values until a patch is available.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2007-6699

Affected Products

Aol You'Ve Got Pictures

References · 7

• 🔥 http://securityfocus.com/bid/27026 · Exploit
• 🔥 http://seclists.org/fulldisclosure/2007/Dec/0561.html · Exploit
• 🔥 https://exploit-db.com/exploits/30936 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-6699 · Security Note
• http://osvdb.org/41198 · Note
• http://seclists.org/fulldisclosure/2007/Dec/0574.html · Note
• http://securitytracker.com/id?1019143 · Note