CVE-2006-5650

El control ActiveX ICQPhone.SipxPhoneManager en America Online ICQ 5.1 permite a atacantes remotos bajar y ejecutar código de su elección mediante la función DownloadAgent, como ha sido demostrado usando un avatar ICQ.

This vulnerability allows attackers to execute arbitrary code on vulnerable installations of AOL ICQ. User interaction is not required to exploit this vulnerability.
The specific flaw exists in the DownloadAgent function of the ICQPhone.SipxPhoneManager ActiveX control with the following CLSID:
54BDE6EC-F42F-4500-AC46-905177444300
The vulnerable function takes a single URI argument of a file to download and execute under the context of the running user. A malicious ICQ avatar can be used as an exploitation vector, allowing attackers to exploit this vulnerability by simply messaging a target ICQ user.