|
AOL Instant Messenger File Transfer Error Message Buffer Overflow Vulnerability
|
|
Secunia Advisory:
|
SA10021
|
|
|
Release Date:
|
2003-10-17
|
|
Popularity:
|
11,067 views
|
|
|
Critical:
|
Moderately critical
|
|
Impact:
|
DoS
System access
|
|
Where:
|
From remote
|
|
Solution Status:
|
Vendor Patch
|
|
| Software: | AOL Instant Messenger 5.x
|
|
|
Subscribe:
|
Instant alerts on relevant vulnerabilities 
|
|
Description:
A vulnerability has been identified in AOL Instant Messenger (AIM), which potentially can be exploited by malicious people to compromise a user's system.
The vulnerability is caused due to a boundary error in the "CCertsByUserName::Cleanup()" function in "AimSecondarySvcs.dll" when constructing certain error messages. The problem is that a "sprintf()" function is used insecurely when constructing an error message to inform the user that the connection with a specified user was unsuccessful.
This can be exploited via a user's browser by constructing a specially crafted link that uses the "aim:" URI handler and requests a "getfile" operation, which supplies an overly long, specially crafted string to the "screenname" parameter.
Example:
aim:getfile?screenname=AAA...[x1130]...AAA
Successful exploitation causes a buffer overflow and may potentially allow execution of arbitrary code. However, it requires the following:
1) A user has to be tricked into visiting a malicious website or clicking a specially crafted link.
2) The user clicks "OK" when an anti-virus warning dialog box pops up unless it has been disabled previously.
The vulnerability has been confirmed in version 5.2.3292 for Windows. However, other versions may also be affected.
Solution:
The vulnerability has been fixed in the latest beta (version 5.5.3415 Beta).
http://www.aim.com/get_aim/win/win_beta.adp
Provided and/or discovered by:
AngryB, Digital Pranksters.
Original Advisory:
Buffer Overflow in AOL Instant Messager's screenname parameter of getfile:
http://www.digitalpranksters.com/advisories/aol/AIMProtocolBO.html
|
|
|
Track this Secunia Advisory
|
Customers of the Secunia Vulnerability Intelligence solutions will automatically receive updates when new information regarding this advisory is released.
Read more about our Vulnerability Intelligence solutions and what they can do for you and your company.
|
|
|
About this Secunia Advisory
|
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
|
