PT-2008-2248 · Yahoo · Yahoo! Music Jukebox

Krystian Kloskowski · Published 2008-02-06 · Updated 2017-09-29 · CVE-2008-0623

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Yahoo! Music Jukebox version 2.2.2.056

Description The issue is a stack-based buffer overflow in the YMP Datagrid ActiveX control, specifically in the datagrid.dll component. This occurs when a long argument is passed to the AddImage method, allowing remote attackers to execute arbitrary code.

Recommendations For Yahoo! Music Jukebox version 2.2.2.056, consider disabling the AddImage method in the YMP Datagrid ActiveX control as a temporary workaround until a patch is available.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2008-0623

Affected Products

Yahoo! Music Jukebox

References · 10

• 🔥 https://exploit-db.com/exploits/5051 · Exploit
• 🔥 http://securityfocus.com/bid/27590 · Exploit
• 🔥 https://exploit-db.com/exploits/5043 · Exploit
• 🔥 https://exploit-db.com/exploits/5048 · Exploit
• 🔥 https://exploit-db.com/exploits/5046 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-0623 · Security Note
• http://vupen.com/english/advisories/2008/0396/references · Note
• http://securitytracker.com/id?1019301 · Note
• http://kb.cert.org/vuls/id/101676 · Note
• http://secunia.com/advisories/28757 · Note