ADVISORY: MSN Messenger OCX Buffer Overflow

MSN Messenger OCX Buffer Overflow Release Date: 5/8/2002 Severity: High Remote code execution Systems Affected: Microsoft MSN Chat Control Microsoft MSN Messenger 4.5 and 4.6, which includes the MSN Chat control Microsoft Exchange Instant Messenger 4.5 and 4.6, which includes the MSN Chat control...

Microsoft MSN Messenger Chat Control contains a buffer overflow in "ResDLL" parameter

Overview Microsoft's MSN Chat is an ActiveX control for Microsoft Messenger, an instant messaging client. A buffer overflow exists in the ActiveX control that may permit a remote attacker to execute arbitrary code on the system with the privileges of the current user. Description A buffer overflo...

w00w00-AIM-2.txt

================================== AOL Instant Messenger Overflow 2 w00w00! http://www.w00w00.org ================================== PRELUDE AOL Instant Messenger is still vulnerable to a serious overflow, as discovered by John Hennessy while tweaking our example exploit, w00aimexp. A few simple...

AOL Instant Messenger installer adds "http://free.aol.com" to Trusted Sites Zone in Microsoft Internet Explorer

Overview The installer for AOL Instant Messenger contains a vulnerability that weakens the security settings of Microsoft Internet Explorer. Description There is a vulnerability in the installer for AOL Instant Messenger AIM that silently adds "http://free.aol.com" to the list of Trusted Sites in...

w00w00 on AOL Instant Messenger remote overflow #2

================================== AOL Instant Messenger Overflow 2 w00w00! http://www.w00w00.org ================================== PRELUDE AOL Instant Messenger is still vulnerable to a serious overflow, as discovered by John Hennessy while tweaking our example exploit, w00aimexp. A few simple...

Misformated message header causes msn messenger to crash

Introduction to the flaw. Msn Messenger is a popular Instant-Messaging client from Microsoft. After the previous flaws regarding the privacy of users another flaw is discovered. This flaw makes the msn messenger client crash after receiving a misformated font variable in the message header with...

CVE-2002-0228

CVE-2002-0228 affects Microsoft MSN Messenger. The vulnerability allows remote attackers to use Javascript referencing an ActiveX object to obtain sensitive information (e.g., display names, web site navigation) when the user is connected to certain Microsoft sites or DNS-spoofed sites. OpenVAS/O...

CVE-2002-0320

CVE-2002-0320: Buffer overflow in Yahoo! Messenger 5.0 allows a remote attacker to cause a denial of service and possibly execute arbitrary code via a long message or the IMvironment field. The CERT advisories specify a remotely exploitable overflow in the message field and in the IMvironment fie...

CVE-2002-0321

Yahoo! Messenger 5.0 is affected by a vulnerability that lets a remote attacker spoof another user’s name in messages, enabling social engineering or a denial-of-service via flooding. The issue arises from the ability to modify the source username used in messages. Impact is described as potentia...

CVE-2002-0322

CVE-2002-0322 affects Yahoo! Messenger 4.0. The vulnerability arises because user passwords are sent in cleartext, enabling remote attackers to sniff credentials and potentially gain privileges of other users. The issue impacts confidentiality and integrity (partial), with a network-based attack ...

CVE-2002-0228

Microsoft MSN Messenger allows remote attackers to use Javascript that references an ActiveX object to obtain sensitive information such as display names and web site navigation, and possibly more when the user is connected to certain Microsoft sites or DNS-spoofed sites...

CVE-2002-0320

Buffer overflow in Yahoo! Messenger 5.0 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long 1 message or 2 IMvironment field...

CVE-2002-0321

Yahoo! Messenger 5.0 allows remote attackers to spoof other users by modifying the username and using the spoofed username for social engineering or denial of service flooding attacks...

CVE-2002-0322

Yahoo! Messenger 4.0 sends user passwords in cleartext, which could allow remote attackers to gain privileges of other users via sniffing...

CVE-2002-0228: Undefined Security Weakness

Microsoft MSN Messenger allows remote attackers to use Javascript that references an ActiveX object to obtain sensitive information such as display names and web site navigation, and possibly more when the user is connected to certain Microsoft sites or DNS-spoofed sites...

CVE-2002-0322: Undefined Security Weakness

Yahoo! Messenger 4.0 sends user passwords in cleartext, which could allow remote attackers to gain privileges of other users via sniffing...

CVE-2002-0321: Undefined Security Weakness

Yahoo! Messenger 5.0 allows remote attackers to spoof other users by modifying the username and using the spoofed username for social engineering or denial of service flooding attacks...

CVE-2002-0320: Undefined Security Weakness

Buffer overflow in Yahoo! Messenger 5.0 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long 1 message or 2 IMvironment field...

AOL Instant Messenger 4.x - Arbitrary File Creation

source: https://www.securityfocus.com/bid/4526/info An issue has been reported, which could allow an AIM user to save files to arbitrary locations. Reportedly, this is achievable when a direct connection is made between two AIM users. Files that are sent to a user include an img tag and a data ta...

CVE-2002-1591

AOL Instant Messenger AIM 4.7.2480 adds free.aol.com to the Trusted Sites Zone in Internet Explorer without user approval, which could allow code from free.aol.com to bypass intended access restrictions...