AOL Instant Messenger <= 4.3.2229 Multiple Overflows

high Nessus Network Monitor Plugin ID 1253

Synopsis

The remote host is vulnerable to a buffer overflow

Description

The remote host is running AOL Instant Messenger (AIM). Version prior to and including 4.3.2229 contain buffer overflows in the code that processes AIM URLs. URLs containing "aim://" along with exceptionally long goim and screenname parameter strings may crash a remote AIM client provided the victim clicks on the link. A victim does NOT have to be running AIM for a remote attacker to exploit this vulnerability.

Solution

Upgrade to the latest version of AOL Instant Messenger.

Plugin Details

Severity: High

ID: 1253

Family: Internet Messengers

Published: 8/20/2004

Updated: 3/6/2019

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: High

Base Score: 9.3

Temporal Score: 7.9

Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C

CVSS v3

Risk Factor: High

Base Score: 7.4

Temporal Score: 6.8

Vector: CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:U/RC:X

Vulnerability Information

CPE: cpe:/a:aol:aim

Reference Information

CVE: CVE-2000-1093, CVE-2000-1094

BID: 2118, 2122

Detections

Analytics