Vulnerability Note VU#41301

AOL Instant Messenger buffer overflow in screename

Overview

A buffer overflow exists in the AOL Instant Messenger (AIM) client versions 3.5.x and prior when accepting the screenname from the command line, or through the aim protocol.

I. Description

AIM installs a protocol on the machine that enables people to post links on their websites, or send them in email messages to friends. For example:

<a href="aim:goim?screenname=myname">Send me an instant message here.</a>

One can also specify command line options to AIM for when it starts. AIM versions 3.5.x and prior contain a buffer overflow. When specifying a screenname using the aim protocol, or command line option, one can trigger a buffer overflow in the client.

II. Impact

A denial of service against the client can occur.

III. Solution

Upgrade to a version of AIM higher than 3.5.x.

Systems Affected

Vendor	Status	Date Notified	Date Updated
AOL Time Warner	Vulnerable	10-Jan-2002

References

http://www.ntbugtraq.com/default.asp?pid=36&sid=1&A2=ind0003&L=ntbugtraq&F=P&S=&P=5479

Credit

This vulnerability was discovered by Joe Testa.

This document was written by Jason Rafail.

Other Information

Date Public:	2000-03-15
Date First Published:	2002-01-16
Date Last Updated:	2002-01-31
CERT Advisory:
CVE-ID(s):
NVD-ID(s):
US-CERT Technical Alerts:
Severity Metric:	1.06
Document Revision:	10

If you have feedback, comments, or additional information about this vulnerability, please send us email.