AOL Instant Messenger 'aim://goaway?message' Buffer Overflow Lets Remote Users Execute Arbitrary Code
|
|
SecurityTracker Alert ID: 1010901
|
|
SecurityTracker URL: http://securitytracker.com/id?1010901
|
|
CVE Reference: CAN-2004-0636
(Links to External Site)
|
Updated: Aug 9 2004
|
Original Entry Date: Aug 9 2004
|
Impact: Execution of arbitrary code via network, User access via network
|
Exploit Included: Yes
Vendor Confirmed: Yes
|
Version(s): 5.5.3595 and prior versions
|
Description: A buffer overflow vulnerability was reported in AOL Instant Messenger (AIM). A remote user can execute arbitrary code on the target system.
Secunia and iDEFENSE reported that a remote user can create a specially crafted 'aim://' URL that, when loaded by the target user,
will trigger a stack overflow and execute arbitrary code.
An away message longer than 1024 bytes can trigger the flaw, the report
said.
An exploit URL may have the following form:
"goaway?message"
Secunia credits Ryan McGeehan and Kevin Benes of TheBillyGoatCurse.com
with reporting this flaw. iDEFENSE credits Matt Murphy with reporting this flaw.
|
Impact: A remote user can cause arbitrary code to be executed on the target user's computer.
|
Solution: No solution was available at the time of this entry. iDEFENSE reports that AOL will release a fixed beta version on August 9, 2004, to be available at:
http://www.aim.com/
|
Vendor URL: www.aim.com/ (Links to External Site)
|
Cause: Boundary error
|
Underlying OS: Windows (Any)
|
|
Message History:
None.
|
Source Message Contents
|
Date: Mon, 09 Aug 2004 11:23:46 -0400
Subject: http://www.k-otik.net/bugtraq/08092004.AIM.php
|
http://www.k-otik.net/bugtraq/08092004.AIM.php
K-OTik reported a buffer overflow vulnerability in AOL Instant Messenger (AIM) version
5.5.3595 and prior versions. A remote user can create a specially crafted 'aim://' URL
that, when loaded by the target user, will trigger a stack overflow and execute arbitrary
code.
An away message longer than 1024 bytes can trigger the flaw, the report said.
An exploit URL may have the following form:
"goaway?message"
The report credits Ryan McGeehan with reporting this flaw.
|
|
