AOL Instant Messenger Arbitrary File Forced Download

high Nessus Network Monitor Plugin ID 1244

Synopsis

An attacker can silently download files to the remote AOL Client

Description

The remote host is running AOL Instant Messenger (AIM). A vulnerability has been discovered in AIM that could allow an attacker to force a user to download an attacker supplied file. If a vulnerable user has an option enabled that allows users to download files without a prompt, it may be possible to force the user to download a file. The file will be transferred without prompting the target user for authorization.

Solution

Disable the option which ignores file transfer prompts.

Plugin Details

Severity: High

ID: 1244

Family: Internet Messengers

Published: 8/20/2004

Updated: 3/6/2019

Vulnerability Information

CPE: cpe:/a:aol:aim

Reference Information

BID: 6259

Detections

Analytics