AOL Desktop 9.6 contains a buffer overflow vulnerability in its Tool\rich.rct component when parsing .rtx files. By embedding an overly long string in a hyperlink tag, an attacker can trigger a stack-based buffer overflow due to the use of unsafe strcpy operations. This allows remote attackers to execute arbitrary code when a victim opens a malicious .rtx file. AOL Desktop is end-of-life and no longer supported, and users are encouraged to migrate to AOL Desktop Gold or alternative platforms.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 8.4 | CVE-2011-10027 |
Exploitation
To exploit this vulnerability, an attacker can create a malicious .rtx file containing an overly long string in a hyperlink tag. When a victim opens this file using AOL Desktop 9.6, the buffer overflow occurs, allowing the attacker to execute arbitrary code on the victim’s machine.
Affected Products
- AOL Desktop 9.6: The application is vulnerable due to a buffer overflow in its Tool\rich.rct component when processing .rtx files.
Mitigation
As AOL Desktop is no longer supported, users are advised to migrate to AOL Desktop Gold or alternative platforms to avoid this vulnerability. Regularly updating software and avoiding the use of unsupported applications can help mitigate risks associated with such vulnerabilities.