AOL You've Got Pictures ActiveX Control (YGPPicFinder.DLL) Overflow

Critical Nessus Plugin ID 20737


The remote Windows host has an ActiveX control that is affected by a buffer overflow vulnerability.


The remote host contains an ActiveX control from AOL called YPG Picture Finder Tool. It was distributed along with various versions of AOL's client software and from the You've Got Pictures website prior to 2004. The 'YGPPicFinder.DLL' component of this control fails to limit the amount of user-supplied data copied to a finite buffer. This can be exploited using a specially crafted web page, for example to overflow the buffer, crash the application using the control (typically Internet Explorer), and possibly execute arbitrary code subject to the user's privileges.


Download and run AOL's removal tool.

See Also

Plugin Details

Severity: Critical

ID: 20737

File Name: ygp_activex_overflow.nasl

Version: $Revision: 1.20 $

Type: local

Agent: windows

Family: Windows

Published: 2006/01/18

Modified: 2015/01/12

Dependencies: 13855

Risk Information

Risk Factor: Critical


Base Score: 10

Temporal Score: 8.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Temporal Vector: CVSS2#E:U/RL:U/RC:C

Vulnerability Information

CPE: cpe:/a:aol:aol_client_software

Required KB Items: SMB/Registry/Enumerated

Exploit Available: false

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 2006/01/16

Reference Information

CVE: CVE-2006-0316

BID: 16262

OSVDB: 22486

CERT: 715730