America Online ICQ ActiveX Control Code Execution Vulnerability

ID ZDI-06-037
Type zdi
Reporter Peter Vreugdenhil
Modified 2006-06-22T00:00:00


This vulnerability allows attackers to execute arbitrary code on vulnerable installations of AOL ICQ. User interaction is not required to exploit this vulnerability. The specific flaw exists in the DownloadAgent function of the ICQPhone.SipxPhoneManager ActiveX control with the following CLSID: 54BDE6EC-F42F-4500-AC46-905177444300 The vulnerable function takes a single URI argument of a file to download and execute under the context of the running user. A malicious ICQ avatar can be used as an exploitation vector, allowing attackers to exploit this vulnerability by simply messaging a target ICQ user.