PT-2009-5930 · Aol · America Online

Published 2009-10-09 · Updated 2024-02-03 · CVE-2009-3658

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions America Online (AOL) version 9.5.0.1

Description The issue is related to a use-after-free vulnerability in the Sb.SuperBuddy.1 ActiveX control, which allows remote attackers to trigger memory corruption or possibly execute arbitrary code. This can be achieved by providing a malformed argument to the SetSuperBuddy method.

Recommendations For America Online (AOL) version 9.5.0.1, consider disabling the SetSuperBuddy method in the Sb.SuperBuddy.1 ActiveX control as a temporary workaround until a patch is available. Restrict access to the sb.dll library to minimize the risk of exploitation. Avoid using the SetSuperBuddy method with untrusted input until the issue is resolved.

Exploit

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2009-3658

Affected Products

America Online

References · 10

• 🔥 https://exploit-db.com/exploits/9992 · Exploit
• 🔥 http://securityfocus.com/bid/36580 · Exploit
• 🔥 http://retrogod.altervista.org/9sg_aol_91_superbuddy.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-3658 · Security Note
• http://vupen.com/english/advisories/2009/2812 · Vendor Advisory
• http://secunia.com/advisories/36919 · Vendor Advisory
• http://securityfocus.com/archive/1/506889/100/0/threaded · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6704 · Note
• https://t.me/cvenotify/69896 · Telegram Post
• https://exchange.xforce.ibmcloud.com/vulnerabilities/53614 · Note