CVE-2011-10027
HIGHAOL Desktop < 9.6 - Stack-based Buffer Overflow via RTX Hyperlink Tag
Title source: llmExploitation Summary
EIP tracks 4 public exploits for CVE-2011-10027.
PoCs published by Metasploit, sickness, sup3r, including Metasploit module exploits/windows/fileformat/aol_desktop_linktag.
AI-analyzed exploit summary This Metasploit module exploits a buffer overflow in AOL Desktop 9.6's rich.rct component via a maliciously crafted hyperlink tag, leading to arbitrary code execution. The exploit uses a JMP ESI technique to redirect execution flow to the payload.
Description
AOL Desktop 9.6 contains a buffer overflow vulnerability in its Tool\rich.rct component when parsing .rtx files. By embedding an overly long string in a hyperlink tag, an attacker can trigger a stack-based buffer overflow due to the use of unsafe strcpy operations. This allows remote attackers to execute arbitrary code when a victim opens a malicious .rtx file. AOL Desktop is end-of-life and no longer supported. Users are encouraged to migrate to AOL Desktop Gold or alternative platforms.
Exploits (4)
This Metasploit module exploits a buffer overflow in AOL Desktop 9.6's rich.rct component via a maliciously crafted hyperlink tag, leading to arbitrary code execution. The exploit uses a JMP ESI technique to redirect execution flow to the payload.
This exploit targets a buffer overflow vulnerability in AOL Desktop 9.6 by crafting a malicious RTX file. It uses a JMP ESI instruction from aolusershell.dll to achieve arbitrary code execution, demonstrated by spawning calc.exe.
This exploit targets a local buffer overflow vulnerability in AOL 9.5 (rtx) by crafting a malicious .rtx file. It uses a NOP sled and shellcode to execute arbitrary commands (calc.exe) via a controlled EIP overwrite.
This Metasploit module exploits a buffer overflow vulnerability in AOL Desktop 9.6's rich.rct component via a crafted hyperlink tag, leading to arbitrary code execution. It includes multiple targets for different Windows versions and NX bypass techniques.
References (6)
Scores
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N