AIM Arbitrary HTML Display in Notification Window

2007.09.17

Credit: shell

Risk: Low

Local: No

Remote: Yes

CVE: CVE-2007-4901

CWE: CWE-noinfo

CVSS Base Score: 5.8/10

Impact Subscore: 4.9/10

Exploitability Subscore: 8.6/10

Exploit range: Remote

Attack complexity: Medium

Authentication: No required

Confidentiality impact: Partial

Integrity impact: Partial

Availability impact: None

Arbitrary HTML can be readily displayed in notification windows generated
by AOL Instant Messenger when the window of origin is not the main focus.
This vulnerability is known to be present at least in version 6.1.41.2
(which is the current release). It appears to display any form of
HTML-compliant code. More details can be provided on request.

Discovery credited to:
Shell ( dotshell.net, shell6 (at) gmail (dot) com [email concealed], shell (at) dotshell (dot) net [email concealed])
Lone (Lone-Matrix.com, Lone (at) Lone-Matrix (dot) com [email concealed] )

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

AIM Arbitrary HTML Display in Notification Window

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.