AOL Instant Messenger Filename Handling Format String

low Nessus Network Monitor Plugin ID 1254

Synopsis

The remote host is vulnerable to format string flaw

Description

The remote host is running AOL Instant Messenger (AIM). Version 4.1.2010 of AIM is vulnerable to a format string attack that may exploited by an attacker to crash a victim's IM client, leading to a denial of service. The vulnerability lies in AIM's improper handling of file transfers of filenames containing "%s".

Solution

Upgrade to the latest version of AOL Instant Messenger.

Plugin Details

Severity: Low

ID: 1254

Family: Internet Messengers

Published: 8/20/2004

Updated: 3/6/2019

Risk Information

VPR

Risk Factor: Low

Score: 3.6

CVSS v2

Risk Factor: Medium

Base Score: 4.3

Temporal Score: 3.6

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P

CVSS v3

Risk Factor: Low

Base Score: 3.7

Temporal Score: 3.5

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:aol:aim

Reference Information

CVE: CVE-2000-1000

BID: 1747

Detections

Analytics