AOL ICQ ActiveX DownloadAgent vulnerability

Added: 12/15/2006 CVE: CVE-2006-5650 BID: 20930 OSVDB: 30220 Background America Online AOL ICQ is a widely used program for communicating with other users on the Internet. Problem The ICQPhone.SipxPhoneManager ActiveX control, which is installed with ICQ, includes a function called DownloadAgent...

AOL ICQ ActiveX DownloadAgent vulnerability

Added: 12/15/2006 CVE: CVE-2006-5650 BID: 20930 OSVDB: 30220 Background America Online AOL ICQ is a widely used program for communicating with other users on the Internet. Problem The ICQPhone.SipxPhoneManager ActiveX control, which is installed with ICQ, includes a function called DownloadAgent...

AOL ICQ ActiveX DownloadAgent vulnerability

Added: 12/15/2006 CVE: CVE-2006-5650 BID: 20930 OSVDB: 30220 Background America Online AOL ICQ is a widely used program for communicating with other users on the Internet. Problem The ICQPhone.SipxPhoneManager ActiveX control, which is installed with ICQ, includes a function called DownloadAgent...

AOL ICQ ActiveX DownloadAgent vulnerability

Added: 12/15/2006 CVE: CVE-2006-5650 BID: 20930 OSVDB: 30220 Background America Online AOL ICQ is a widely used program for communicating with other users on the Internet. Problem The ICQPhone.SipxPhoneManager ActiveX control, which is installed with ICQ, includes a function called DownloadAgent...

CVE-2006-5650

The ICQPhone.SipxPhoneManager ActiveX control in America Online ICQ 5.1 allows remote attackers to download and execute arbitrary code via the DownloadAgent function, as demonstrated using an ICQ avatar...

CVE-2006-5650

The ICQPhone.SipxPhoneManager ActiveX control in America Online ICQ 5.1 allows remote attackers to download and execute arbitrary code via the DownloadAgent function, as demonstrated using an ICQ avatar...

CVE-2006-5650

The CVE-2006-5650 vulnerability affects AOL ICQ 5.1 via the ICQPhone.SipxPhoneManager ActiveX control. The flaw resides in the DownloadAgent function, which downloads a file from a given URL and executes it, enabling a remote attacker to run arbitrary code on the victim’s system (in the context o...

America Online ICQ ActiveX控件远程代码执行漏洞

ICQ是一款非常流行的即时通讯聊天工具。 ICQ安装的ICQPhone.SipxPhoneManager ActiveX控件实现上存在漏洞，远程攻击者可能利用此漏洞在用户机器上执行任意指令。 ICQ中CLSID为54BDE6EC-F42F-4500-AC46-905177444300的ICQPhone.SipxPhoneManager ActiveX控件的DownloadAgent函数中存在安全漏洞。这个函数取了文件的单个URI参数下载文件并以当前用户的权限执行，因此攻击者可以通过向目标ICQ用户发送消息导致执行任意代码。 AOL ICQ 5.1...

ICQ code execution

Unsafe function of ICQPhone.SipxPhoneManager ActiveX control allows to download and execute malware code from ICQ message or Web page...

America Online ICQ ActiveX Control Code Execution Vulnerability

This vulnerability allows attackers to execute arbitrary code on vulnerable installations of AOL ICQ. User interaction is not required to exploit this vulnerability. The specific flaw exists in the DownloadAgent function of the ICQPhone.SipxPhoneManager ActiveX control with the following CLSID:...

[Full-disclosure] ZDI-06-037: America Online ICQ ActiveX Control Code Execution Vulnerability

ZDI-06-037: America Online ICQ ActiveX Control Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-06-037.html November 6, 2006 -- CVE ID: CVE-2006-5650 -- Affected Vendor: America Online -- Affected Products: America Online ICQ 5.1 -- TippingPointTM IPS Customer...

America Online ICQ 5.1 - ActiveX Control Remote Code Execution

America Online ICQ 5.1 - ActiveX Control Remote Code Execution source: https://www.securityfocus.com/bid/20930/info The America Online ICQ ActiveX Control is prone to a remote code-execution vulnerability. An attacker could exploit this issue simply by sending a message to a victim ICQ user...

CVE-2006-5724

Heap-based buffer overflow the "Answering Service" function in ICQ 2003b Build 3916 allows local users to cause a denial of service application crash via a long string in the "AwayMsg Presets" value in the ICQ\ICQPro\DefaultPrefs\Presets registry key...

CVE-2006-5724

The CVE-2006-5724 entry describes a heap-based buffer overflow in ICQ 2003b Build 3916, specifically in the Answering Service function. The vulnerability can be triggered by a long string in the AwayMsg Presets value stored under ICQ\ICQPro\DefaultPrefs\Presets, allowing a local user to cause an ...

CVE-2006-5724

Heap-based buffer overflow the "Answering Service" function in ICQ 2003b Build 3916 allows local users to cause a denial of service application crash via a long string in the "AwayMsg Presets" value in the ICQ\ICQPro\DefaultPrefs\Presets registry key...

ICQ Pro 2003b远程堆溢出漏洞

ICQ是一款流行的即时通讯聊天工具。 ICQ Pro 2003b build 3916客户端处理特定类型消息的长度时存在堆溢出漏洞，可能导致拒绝服务或远程执行任意代码 受影响系统： AOL ICQ Pro 2003b 不受影响系统： AOL ICQ 5.1 厂商补丁： AOL --- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.icq.com/...

ICQ Toolbar 1.3 for IE多个安全漏洞

ICQ Toolbar是一个可安装于IE的工具栏，通过HTML页面提供基于web的配置界面。 ICQ Toolbar没有验证所加载Web页面的位置或来源，因此可以从本地系统或在线配置工具栏。这允许攻击者轻易的拷贝本地保存的options2.html文件的内容并做为html文件上传到任意站点。 每个复选框控件关联到配置设置的方法仅仅是将每个HTML复选框标签的ID属性匹配到期望配置ID的列表。这允许攻击者更改复选框控件的外部表现以掩饰攻击。只要ID属性匹配了相关的配置设置，攻击者就可以向用户浏览器中呈现任意HTML。上述两个漏洞都允许攻击者读取并更改ICQ工具栏配置。 标准RSS feed...

AOL ICQ Pro fails to properly handle incoming message lengths

Overview A buffer overflow vulnerability in ICQ may allow a remote attacker to execute arbitrary code or create a denial-of-service condition. Description ICQ is a instant messaging application that is maintained by AOL. A buffer overflow vulnerability in ICQ Pro 2003b may allow a remote,...

CVE-2006-4662

Heap-based buffer overflow in the MCRegExSearch function in AOL ICQ Pro 2003b Build 3916 and earlier allows remote attackers to execute arbitrary code via an inconsistent length field of a Message in a 0x2711 Type-Length-Value TLV type...

CVE-2006-4661

AOL ICQ Toolbar 1.3 for Internet Explorer toolbaru.dll does not properly validate the origin of the configuration web page options2.html, which allows user-assisted remote attackers to provide a web page that contains disguised checkboxes that trick the user into reconfiguring the toolbar...