Hole in AOL Instant Messenger

Hello all, This morning I noticed something while playing around with the aim:AddBuddy hyperlink for AIM. If you add many characters separated by commas you can crash the aim when a user clicks it. An example: aim:AddBuddy? ScreenName=InterWN,InterWN,InterWN,InterWN,InterWN,InterWN,I...

Buffer overflow in AOL Instant Messanger

Buffer overflow on game request processing. Array boundary tracersal on aim: URL processing...

w00w00-AIM-2.txt

================================== AOL Instant Messenger Overflow 2 w00w00! http://www.w00w00.org ================================== PRELUDE AOL Instant Messenger is still vulnerable to a serious overflow, as discovered by John Hennessy while tweaking our example exploit, w00aimexp. A few simple...

AOL Instant Messenger installer adds "http://free.aol.com" to Trusted Sites Zone in Microsoft Internet Explorer

Overview The installer for AOL Instant Messenger contains a vulnerability that weakens the security settings of Microsoft Internet Explorer. Description There is a vulnerability in the installer for AOL Instant Messenger AIM that silently adds "http://free.aol.com" to the list of Trusted Sites in...

w00w00 on AOL Instant Messenger remote overflow #2

================================== AOL Instant Messenger Overflow 2 w00w00! http://www.w00w00.org ================================== PRELUDE AOL Instant Messenger is still vulnerable to a serious overflow, as discovered by John Hennessy while tweaking our example exploit, w00aimexp. A few simple...

Misformated message header causes msn messenger to crash

Introduction to the flaw. Msn Messenger is a popular Instant-Messaging client from Microsoft. After the previous flaws regarding the privacy of users another flaw is discovered. This flaw makes the msn messenger client crash after receiving a misformated font variable in the message header with...

AOL Instant Messenger 4.x - Arbitrary File Creation

source: https://www.securityfocus.com/bid/4526/info An issue has been reported, which could allow an AIM user to save files to arbitrary locations. Reportedly, this is achievable when a direct connection is made between two AIM users. Files that are sent to a user include an img tag and a data ta...

CVE-2002-1591

AOL Instant Messenger AIM 4.7.2480 adds free.aol.com to the Trusted Sites Zone in Internet Explorer without user approval, which could allow code from free.aol.com to bypass intended access restrictions...

AOL Instant Messenger vulnerable to DoS via crafted GIF file

Overview AOL Instant Messenger AIM is an application that allows one peer to communicate with another. A vulnerability exists that can crash the client of a victim. Description AIM allows users to send image files to one another. By sending a crafted GIF image, an attacker can cause the victim's...

AOL Instant Messenger vulnerable to denial of service via crafted file name

Overview AOL Instant Messenger AIM 4.1 and prior are vulnerable to a denial of service vulnerability. A denial of service occurs when filenames that contain a "%s" are sent to a victim. Description AOL Instant Messenger AIM is a program for communicating with other users over the Internet. AIM...

AOL Instant Messenger contains buffer overflows in parsing of AIM URI handler requests

Overview AOL Instant Messenger AIM is an application that allows one peer to communicate with another. A buffer overflow vulnerability exists that can manipulate the configuration of the victim's client. Description AIM installs a URI handler that permits the use of the "aim:" protocol on the...

AOL Instant Messenger saves code embedded in image tag to conversation log which could be viewed/executed by a browser

Overview Certain Alpha versions of AOL Instant Messenger AIM, that were leaked, would log errors to a log file. By sending a crafted image file, it may be possible to execute arbitrary script/HTML on a victims browser when they view the log files. Description AOL Instant Messenger has the ability...

Instant Web Mail additional POP3 commands and mail headers

Instant Web Mail additional POP3 commands and mail headers PROGRAM: Instant Web Mail VENDOR: Jonas Koch Bentzen [email protected] HOMEPAGE: http://understroem.dk/instantwebmail/ VULNERABLE VERSIONS: 0.59 possibly earlier versions too TYPE: remote/local SEVERITY: medium DESCRIPTION: "Instant We...

Potential vulnerabilities of the Microsoft RVP-based Instant Messaging

The Encode Security Labs performed an empirical analysis of the Microsoft Instant Messaging implementation based on Exchange 2000 and using the MSN Messenger Service v3.6 client. The most important findings about the IM service are: -it does not offer any confidentiality -it is vulnerable to...

CVE-2002-0005

CVE-2002-0005 describes a remote buffer overflow in AOL Instant Messenger (AIM) on Windows triggered by a crafted AddGame request, allowing arbitrary code execution. Vulnerable AIM Windows clients include versions 1.0–3.0.1415 and 4.3.2229+ (4.8.2616 cited); the issue involves parsing a long argu...

CVE-2002-0005

Buffer overflow in AOL Instant Messenger AIM 4.7.2480, 4.8.2616, and other versions allows remote attackers to execute arbitrary code via a long argument in a game request AddGame...

AOL Instant Messenger 4.x - Hyperlink Denial of Service

AOL Instant Messenger 4.x - Hyperlink Denial of Service source: https://www.securityfocus.com/bid/4244/info AOL Instant Messenger AIM is a real time messaging service. The AIM client runs on Microsoft Windows operating systems. It is possible to crash the AIM client by sending a specially formatt...

AOL Instant Messenger 4.x - Hyperlink Denial of Service

source: https://www.securityfocus.com/bid/4244/info AOL Instant Messenger AIM is a real time messaging service. The AIM client runs on Microsoft Windows operating systems. It is possible to crash the AIM client by sending a specially formatted hyper-link to a user. When the user attempts to launc...

Получение пароля AOL Instant Messenger

Можно получить пароль AOL Instant Messenger создав учетную запись AOL с тем же именем...

AOL/AOL Instant Messenger Vulnerability

AOL/AOL Instant Messenger Vulnerability -------------------------------------------------------------------------------- Author: Robert Lyttle [email protected] Contributors: r0cky Release Date: 02.24.02 - 2:00 AM Disclaimer: http://www.sub-seven.com and/or Robert Lyttle is not responsible for...