Yahoo! Music Jukebox ActiveX Controls Buffer Overflows

NASLDB: Yahoo! Music Jukebox ActiveX Controls Buffer Overflows

General

ID: 30205
Name: Yahoo! Music Jukebox ActiveX Controls Buffer Overflows

Summary: Checks version of affected ActiveX controls

Credits: –

Classification

Risk: –

CVSS: –
CVSS Base Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C
CVSS Temporal Vector: CVSS2#E:F/RL:OF/RC:C

Port: 139
Family: Windows
Type: Local

Description

The remote host contains the ‘DataGrid’ and/or ‘MediaGrid’ ActiveX
controls included with Yahoo! Music Jukebox.

These controls are reportedly affected by multiple buffer overflows
involving, for example, the ‘AddButton’ and ‘AddImage’ methods of the
‘DataGrid’ control and ‘AddBitmap’ method of the ‘MediaGrid’ control.
If an attacker can trick a user on the affected host into visiting a
specially crafted web page, he may be able to leverage these issues to
execute arbitrary code on the host subject to the user’s privileges.