search menu icon-carat-right cmu-wordmark

CERT Coordination Center


AOL Instant Messenger vulnerable to DoS via crafted WAV file

Vulnerability Note VU#990451

Original Release Date: 2002-01-14 | Last Revised: 2002-01-14

Overview

AOL Instant Messenger (AIM) is an application that allows one peer to communicate with another. A vulnerability exists that can crash the client of a victim.

Description

AIM allows users to send audio files to one another. By sending a corrupt WAV formatted file, an attacker can cause the victims client to crash.

Impact

By repeatedly sending this message with the file attached, a continued denial of service can be caused.

Solution

Upgrade your client. This has been fixed in version 4.8.2540 beta.

AIM permits the user to only accept messages from known/trusted peers. Enable this feature.

Vendor Information

990451
Expand all

AOL Time Warner

Notified:  October 17, 2001 Updated:  January 14, 2002

Status

  Vulnerable

Vendor Statement

This is fixed in our latest Win AIM Beta 4.8.2540 posted Nov. 19th.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

Win AIM Beta 4.8.2540 was posted on Nov. 19th, 2001.

If you have feedback, comments, or additional information about this vulnerability, please send us email.


CVSS Metrics

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A

References

Credit

This vulnerability was discovered by Robbie Saunders.

This document was written by Jason Rafail.

Other Information

CVE IDs: None
Severity Metric: 8.51
Date Public: 2001-10-06
Date First Published: 2002-01-14
Date Last Updated: 2002-01-14 18:25 UTC
Document Revision: 8

Sponsored by the Department of Homeland Security Office of Cybersecurity and Communications.