OSVDB ID: 61964

Title: AOL Phobos.Playlist (Phobos.dll) ActiveX Import() Function Overflow

Info

Disclosure
Jan 20, 2010

Discovery
Unknown

Dates

Exploit
Jan 20, 2010

Solution
Unknown

Description

 AOL is prone to an overflow condition. The Phobos.Playlist ActiveX control fails to properly sanitize user-supplied input resulting in a stack overflow. With a specially crafted website, a context-dependent attacker can potentially cause arbitrary code execution.

Classification

 Location: Remote / Network Access, Context Dependent
Attack Type: Input Manipulation
Impact: Loss of Integrity
Solution: Workaround
Exploit: Exploit Public
Disclosure: Uncoordinated Disclosure
OSVDB: Web Related

Solution

 Currently, there are no known upgrades or patches to correct this vulnerability. It is possible to correct the flaw by implementing the following workaround: set the kill-bit on the Phobos.Playlist ActiveX Control <(CLSID A105BD70-BF56-4D10-BC91-41C88321F47C)>. See Microsoft KB article 240797 for additional details.

Products

America Online, Inc.

AOL

 9.5
9.5

References

Credit

Unknown or Incomplete


Direct URL: http://osvdb.org/61964