The Channel logo


By | John Leyden 1st February 2008 13:02

Image uploader bug blights MySpace

Nasty ActiveExploit

Security flaws in an ActiveX control used in MySpace upload images onto the social networking sites leave users open to attack. Facebook users may also be at risk.

A buffer overflow vulnerability in Aurigma's Image Uploader Control Library might be used to compromise a user's system. The affected control is used for uploading images onto social networking sites using Microsoft's Internet Explorer. Users might be vulnerable if tricked into visiting a specially crafted web page that exploits the vulnerability.

The flaw was first reported by Elazar Broad on a full disclosure mailing list, who said that the vulnerable control was used by MySpace. Facebook also reportedly repackages the Aurigma control, though which version it uses is unclear. Broad reported the problem to Aurigma.

Aurigma, a Washington-based software developer, acknowledged that version 4.5.70 of its control was vulnerable but said that later versions of its software were safe from attack. It didn't comment on the use of its software on social networking sites.

Security notification firm Secunia advises MySpace users to set the "kill-bit" for the affected ActiveX control, which is known as MySpaceUploader.ocx version Advise from Microsoft on how to disable vulnerable ActiveX controls can be found here. ®

comment icon Read 6 comments on this article alert Send corrections


Frank Jennings

What do you do? Use manual typwriters or live in a Scottish croft? Our man advises
A rusty petrol pump at an abandoned gas station. Pic by Silvia B. Jakiello via shutterstock

Trevor Pott

Among other things, Active Directory needs an overhaul
Baby looks taken aback/shocked/affronted. Photo by Shutterstock

Kat Hall

Plans for 2 million FTTP connections in next four years 'not enough'
Microsoft CEO Satya Nadella


League of gentlemen poster - Tubbs and Edward at the local shop. Copyright BBC
One reselling man tells his tale of woe