Full Disclosure mailing list archives
MySpace Uploader ActiveX Control Buffer Overflow
From: "Elazar Broad" <elazar () hushmail com>
Date: Thu, 31 Jan 2008 02:23:08 -0500
Who: MySpace http://www.myspace.com What: MySpace repackages Aurigma's ImageUploader ActiveX. This control enables MySpace users to upload images to their MySpace page(s). How: MySpaceUploader.ocx version 1.0.0.4 {48DD0448-9209-4F81-9F6D-D83562940134} This control is vulnerable to a buffer overflow in the Action property. I believe FaceBook also uses/repackages the Aurigma control, I don't know which version though. Fix: No official fix known Vendor notified Workaround: Set the KillBit for this control, see http://support.microsoft.com/kb/240797 Elazar -- Boost your business with a small business loan. Click now! http://tagline.hushmail.com/fc/Ioyw6h4euX1tlqACEpmeqPPYJCrC9PY9DoHGlDkrJ01F6c5ss0X4SU/ _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- MySpace Uploader ActiveX Control Buffer Overflow Elazar Broad (Jan 31)