CVE-2006-5650

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

• America Online ICQ 5.1 - ActiveX Control Remote Code Execution2006-11-06 · remote · windows · Verified
• America Online ICQ - ActiveX Control Arbitrary File Download and Execute (Metasploit)2010-11-24 · remote · windows · Verified

Impact

The ICQPhone.SipxPhoneManager ActiveX control in America Online ICQ 5.1 allows remote attackers to download and execute arbitrary code via the DownloadAgent function, as demonstrated using an ICQ avatar.

Affected products

References

• NVD record
• CVE.org record
• http://secunia.com/advisories/22670
• http://securityreason.com/securityalert/1830
• http://securitytracker.com/id?1017163
• http://www.securityfocus.com/archive/1/450726/100/0/threaded
• http://www.securityfocus.com/bid/20930
• http://www.vupen.com/english/advisories/2006/4362
• http://www.zerodayinitiative.com/advisories/ZDI-06-037.html
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30059
• http://secunia.com/advisories/22670
• http://securityreason.com/securityalert/1830
• http://securitytracker.com/id?1017163
• http://www.securityfocus.com/archive/1/450726/100/0/threaded
• http://www.securityfocus.com/bid/20930
• http://www.vupen.com/english/advisories/2006/4362
• http://www.zerodayinitiative.com/advisories/ZDI-06-037.html
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30059