CVE-2006-6442

Stack-based buffer overflow in the SetClientInfo function in the CDDBControlAOL.CDDBAOLControl ActiveX control (cddbcontrol.dll), as used in America Online (AOL) 7.0 4114.563, 8.0 4129.230, and 9.0 Security Edition 4156.910, and possibly other products, allows remote attackers to execute arbitrary code via a long ClientId argument.

CVSS v2.0 9.3 HIGH

9.3^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:M/Au:N/C:C/I:C/A:C

Exploitability : 8.6 / Impact : 10.0

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://secunia.com/secunia_research/2006-69/advisory/	Vendor Advisory
http://www.securityfocus.com/bid/21488
http://secunia.com/advisories/23043	Vendor Advisory
http://lists.grok.org.uk/pipermail/full-disclosure/2006-December/051230.html
http://attrition.org/pipermail/vim/2006-December/001173.html
http://securitytracker.com/id?1017357
http://www.vupen.com/english/advisories/2006/4904	Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/30790
http://www.securityfocus.com/archive/1/454105/100/0/threaded

Advertisement

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:aol:aol_client_software:7.0_4114.563:::::::*
	cpe:2.3:a:aol:aol_client_software:8.0_4129.230:::::::*
	cpe:2.3:a:aol:aol_client_software:9.0::security_4156.910:::::

Information

Published : 2006-12-10 03:28

Updated : 2018-10-17 14:48

NVD link : CVE-2006-6442

Mitre link : CVE-2006-6442

JSON object : View

CWE

CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Advertisement

Products Affected

aol

aol_client_software

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://secunia.com/secunia_research/2006-69/advisory/", "name": "http://secunia.com/secunia_research/2006-69/advisory/", "tags": ["Vendor Advisory"], "refsource": "MISC"}, {"url": "http://www.securityfocus.com/bid/21488", "name": "21488", "tags": [], "refsource": "BID"}, {"url": "http://secunia.com/advisories/23043", "name": "23043", "tags": ["Vendor Advisory"], "refsource": "SECUNIA"}, {"url": "http://lists.grok.org.uk/pipermail/full-disclosure/2006-December/051230.html", "name": "20061211 Secunia Research: AOL CDDBControl ActiveX Control \"SetClientInfo()\" Buffer Overflow", "tags": [], "refsource": "FULLDISC"}, {"url": "http://attrition.org/pipermail/vim/2006-December/001173.html", "name": "20061211 GraceNote CDDBControl (CVE-2006-3134) = CDDBAOLControl (CVE-2006-6442)", "tags": [], "refsource": "VIM"}, {"url": "http://securitytracker.com/id?1017357", "name": "1017357", "tags": [], "refsource": "SECTRACK"}, {"url": "http://www.vupen.com/english/advisories/2006/4904", "name": "ADV-2006-4904", "tags": ["Vendor Advisory"], "refsource": "VUPEN"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/30790", "name": "aol-cddbcontrol-bo(30790)", "tags": [], "refsource": "XF"}, {"url": "http://www.securityfocus.com/archive/1/454105/100/0/threaded", "name": "20061211 Secunia Research: AOL CDDBControl ActiveX Control\"SetClientInfo()\" Buffer Overflow", "tags": [], "refsource": "BUGTRAQ"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Stack-based buffer overflow in the SetClientInfo function in the CDDBControlAOL.CDDBAOLControl ActiveX control (cddbcontrol.dll), as used in America Online (AOL) 7.0 4114.563, 8.0 4129.230, and 9.0 Security Edition 4156.910, and possibly other products, allows remote attackers to execute arbitrary code via a long ClientId argument."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-119"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2006-6442", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 9.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "severity": "HIGH", "impactScore": 10.0, "obtainAllPrivilege": true, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}}, "publishedDate": "2006-12-10T11:28Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:aol:aol_client_software:7.0_4114.563:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:aol:aol_client_software:8.0_4129.230:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:aol:aol_client_software:9.0:*:security_4156.910:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2018-10-17T21:48Z"}