search menu icon-carat-right cmu-wordmark

CERT Coordination Center


AOL Instant Messenger exposes local file path during file transfers

Vulnerability Note VU#24447

Original Release Date: 2002-01-31 | Last Revised: 2002-01-31

Overview

AOL Instant Messenger (AIM) disclose local file paths during transfer.

Description

AOL Instant Messenger (AIM) is a program for communicating with other users over the Internet. AIM permits users to transfer files from one client to another. When the file is transferred, the entire local path of the file on the sender's machine is sent to the recipient. This could pose privacy and security risks. An attacker could use this information to extrapolate the location of other files on the victim's machine, and use this information in conjunction with another vulnerability.

Impact

Unauthorized disclosure of information about the victim's machine is transmitted to the attacker.

Solution

The latest version of AIM allows the user to configure whether the recipient can see the full path of a transferred file. Upgrade to the latest build and enable this feature.

Vendor Information

24447
Expand all

AOL Time Warner

Notified:  October 17, 2001 Updated:  January 28, 2002

Status

  Vulnerable

Vendor Statement

This is fixed. There is now a checkbox on the Send File dialog that lets the user choose whether they want the recipient to see the full pathname of the file that is being sent.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.


CVSS Metrics

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A

References

Credit

Our thanks to Daniel P. Stasinski <daniels@karemor.com>, who discovered this vulnerability.

This document was written by Jason Rafail

Other Information

CVE IDs: CVE-2000-0383
Severity Metric: 0.69
Date Public: 2000-05-08
Date First Published: 2002-01-31
Date Last Updated: 2002-01-31 21:37 UTC
Document Revision: 8

Sponsored by the Department of Homeland Security Office of Cybersecurity and Communications.