AOL You've Got Pictures ActiveX Control (YGPPicFinder.DLL) Overflow
Critical Nessus Plugin ID 20737
SynopsisThe remote Windows host has an ActiveX control that is affected by a buffer overflow vulnerability.
DescriptionThe remote host contains an ActiveX control from AOL called YPG Picture Finder Tool. It was distributed along with various versions of AOL's client software and from the You've Got Pictures website prior to 2004. The 'YGPPicFinder.DLL' component of this control fails to limit the amount of user-supplied data copied to a finite buffer. This can be exploited using a specially crafted web page, for example to overflow the buffer, crash the application using the control (typically Internet Explorer), and possibly execute arbitrary code subject to the user's privileges.
SolutionDownload and run AOL's removal tool.