CVE-2006-5650

The ICQPhone.SipxPhoneManager ActiveX control in America Online ICQ 5.1 allows remote attackers to download and execute arbitrary code via the DownloadAgent function, as demonstrated using an ICQ avatar.

CVSS v2.0 7.5 HIGH

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://www.zerodayinitiative.com/advisories/ZDI-06-037.html	Vendor Advisory
http://www.securityfocus.com/bid/20930
http://secunia.com/advisories/22670	Vendor Advisory
http://securitytracker.com/id?1017163
http://securityreason.com/securityalert/1830
http://www.vupen.com/english/advisories/2006/4362
https://exchange.xforce.ibmcloud.com/vulnerabilities/30059
http://www.securityfocus.com/archive/1/450726/100/0/threaded

Advertisement

Configurations

Configuration 1 (hide)

cpe:2.3:a:aol:icq:5.1:*:*:*:*:*:*:*

Information

Published : 2006-11-07 11:07

Updated : 2018-10-17 14:44

NVD link : CVE-2006-5650

Mitre link : CVE-2006-5650

JSON object : View

CWE

NVD-CWE-Other

Advertisement

Products Affected

aol

icq

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://www.zerodayinitiative.com/advisories/ZDI-06-037.html", "name": "http://www.zerodayinitiative.com/advisories/ZDI-06-037.html", "tags": ["Vendor Advisory"], "refsource": "MISC"}, {"url": "http://www.securityfocus.com/bid/20930", "name": "20930", "tags": [], "refsource": "BID"}, {"url": "http://secunia.com/advisories/22670", "name": "22670", "tags": ["Vendor Advisory"], "refsource": "SECUNIA"}, {"url": "http://securitytracker.com/id?1017163", "name": "1017163", "tags": [], "refsource": "SECTRACK"}, {"url": "http://securityreason.com/securityalert/1830", "name": "1830", "tags": [], "refsource": "SREASON"}, {"url": "http://www.vupen.com/english/advisories/2006/4362", "name": "ADV-2006-4362", "tags": [], "refsource": "VUPEN"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/30059", "name": "aol-icq-code-execution(30059)", "tags": [], "refsource": "XF"}, {"url": "http://www.securityfocus.com/archive/1/450726/100/0/threaded", "name": "20061106 ZDI-06-037: America Online ICQ ActiveX Control Code Execution Vulnerability", "tags": [], "refsource": "BUGTRAQ"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "The ICQPhone.SipxPhoneManager ActiveX control in America Online ICQ 5.1 allows remote attackers to download and execute arbitrary code via the DownloadAgent function, as demonstrated using an ICQ avatar."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2006-5650", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "severity": "HIGH", "impactScore": 6.4, "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": true, "userInteractionRequired": false}}, "publishedDate": "2006-11-07T19:07Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:aol:icq:5.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2018-10-17T21:44Z"}