search menu icon-carat-right cmu-wordmark

CERT Coordination Center

AOL Instant Messenger vulnerable to DoS via crafted packets

Vulnerability Note VU#507771

Original Release Date: 2002-01-31 | Last Revised: 2002-01-31


AOL Instant Messenger (AIM) is an application that allows one peer to communicate with another. A vulnerability exists that can crash the client window.


All versions of AIM for Windows proir to beta version 4.8.2540 contain a buffer overflow that permits an attacker to cause a denial of service. It is not believed that arbitrary code can be executed through the exploitation of this vulnerability. By sending numerous HTML comments "<--", an attacker can cause the victim's client to crash. The denial of service can occur even if the victim does not accept messages from users not on their buddy list.


By repeatedly sending this message, a continued denial of service can be caused.


This has been resolved in AIM for Windows beta version 4.8.2540.

Vendor Information


AOL Time Warner Affected

Notified:  October 17, 2001 Updated: January 28, 2002



Vendor Statement

This is fixed in our latest Win AIM Beta 4.8.2540 posted Nov. 19th.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.


The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

CVSS Metrics

Group Score Vector



Our thanks to Leon for discovering this vulnerability.

This document was written by Jason Rafail

Other Information

CVE IDs: None
Severity Metric: 7.92
Date Public: 2001-10-01
Date First Published: 2002-01-31
Date Last Updated: 2002-01-31 21:09 UTC
Document Revision: 9

Sponsored by CISA.