CVE-2006-5650

The ICQPhone.SipxPhoneManager ActiveX control in America Online ICQ 5.1 allows remote attackers to download and execute arbitrary code via the DownloadAgent function, as demonstrated using an ICQ avatar.

CVSS v2.0 7.5 HIGH

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://secunia.com/advisories/22670	Vendor Advisory
http://securityreason.com/securityalert/1830
http://securitytracker.com/id?1017163
http://www.securityfocus.com/archive/1/450726/100/0/threaded
http://www.securityfocus.com/bid/20930
http://www.vupen.com/english/advisories/2006/4362
http://www.zerodayinitiative.com/advisories/ZDI-06-037.html	Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/30059

Configurations

Configuration 1 (hide)

cpe:2.3:a:aol:icq:5.1:*:*:*:*:*:*:*

History

No history.

Information

Published : 2006-11-07 19:07

Updated : 2018-10-17 21:44

NVD link : CVE-2006-5650

Mitre link : CVE-2006-5650

CVE.ORG link : CVE-2006-5650

JSON object : View

Products Affected

aol

icq

CWE

NVD-CWE-Other

{"id": "CVE-2006-5650", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": true, "userInteractionRequired": false}]}, "published": "2006-11-07T19:07:00.000", "references": [{"url": "http://secunia.com/advisories/22670", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://securityreason.com/securityalert/1830", "source": "cve@mitre.org"}, {"url": "http://securitytracker.com/id?1017163", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/archive/1/450726/100/0/threaded", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/20930", "source": "cve@mitre.org"}, {"url": "http://www.vupen.com/english/advisories/2006/4362", "source": "cve@mitre.org"}, {"url": "http://www.zerodayinitiative.com/advisories/ZDI-06-037.html", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/30059", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "The ICQPhone.SipxPhoneManager ActiveX control in America Online ICQ 5.1 allows remote attackers to download and execute arbitrary code via the DownloadAgent function, as demonstrated using an ICQ avatar."}, {"lang": "es", "value": "El control ActiveX ICQPhone.SipxPhoneManager en America Online ICQ 5.1 permite a atacantes remotos bajar y ejecutar c\u00f3digo de su elecci\u00f3n mediante la funci\u00f3n DownloadAgent, como ha sido demostrado usando un avatar ICQ."}], "lastModified": "2018-10-17T21:44:07.613", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:aol:icq:5.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "ED88ADE2-841A-4983-AC47-F7039C26F140"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}