Vulnerability Note VU#24447

AOL Instant Messenger exposes local file path during file transfers

Original Release date: 31 Jan 2002 | Last revised: 31 Jan 2002

Overview

AOL Instant Messenger (AIM) disclose local file paths during transfer.

Description

AOL Instant Messenger (AIM) is a program for communicating with other users over the Internet. AIM permits users to transfer files from one client to another. When the file is transferred, the entire local path of the file on the sender's machine is sent to the recipient. This could pose privacy and security risks. An attacker could use this information to extrapolate the location of other files on the victim's machine, and use this information in conjunction with another vulnerability.

Impact

Unauthorized disclosure of information about the victim's machine is transmitted to the attacker.

Solution

The latest version of AIM allows the user to configure whether the recipient can see the full path of a transferred file. Upgrade to the latest build and enable this feature.

Systems Affected (Learn More)

VendorStatusDate NotifiedDate Updated
AOL Time WarnerAffected17 Oct 200128 Jan 2002
If you are a vendor and your product is affected, let us know.

CVSS Metrics (Learn More)

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A N/A

References

Credit

Our thanks to Daniel P. Stasinski <daniels@karemor.com>, who discovered this vulnerability.

This document was written by Jason Rafail

Other Information

  • CVE IDs: CAN-2000-0383
  • Date Public: 08 May 2000
  • Date First Published: 31 Jan 2002
  • Date Last Updated: 31 Jan 2002
  • Severity Metric: 0.69
  • Document Revision: 8

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.