AIM Arbitrary HTML Display in Notification Window

2007.09.17

Credit: shell

Risk: Low

Local: No

Remote: Yes

CVE: CVE-2007-4901

CWE: CWE-noinfo

Ogólna skala CVSS: 5.8/10

Znaczenie: 4.9/10

Łatwość wykorzystania: 8.6/10

Wymagany dostęp: Zdalny

Złożoność ataku: Średnia

Autoryzacja: Nie wymagana

Wpływ na poufność: Częściowy

Wpływ na integralność: Częściowy

Wpływ na dostępność: Brak

Arbitrary HTML can be readily displayed in notification windows generated
by AOL Instant Messenger when the window of origin is not the main focus.
This vulnerability is known to be present at least in version 6.1.41.2
(which is the current release). It appears to display any form of
HTML-compliant code. More details can be provided on request.

Discovery credited to:
Shell ( dotshell.net, shell6 (at) gmail (dot) com [email concealed], shell (at) dotshell (dot) net [email concealed])
Lone (Lone-Matrix.com, Lone (at) Lone-Matrix (dot) com [email concealed] )

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

AIM Arbitrary HTML Display in Notification Window

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.