PT-2007-6220 · Aol+1 · Aol Instant Messenger+1

Publicado 2007-09-27 · Atualizado 2018-10-15 · CVE-2007-5124

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions AOL Instant Messenger (AIM) versions 6.5.3.12 and earlier

Description The issue allows remote attackers to execute arbitrary code via unspecified web script or HTML in an instant message. This is related to AIM's filtering of specific tags and attributes and the lack of Local Machine Zone lockdown.

Recommendations For AOL Instant Messenger (AIM) versions 6.5.3.12 and earlier, consider disabling the embedded Internet Explorer server control as a temporary workaround until a patch is available. Restrict the use of instant messaging features that may process web scripts or HTML to minimize the risk of exploitation.

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2007-5124

Produtos afetados

Aol Instant Messenger

Internet Explorer

Referências · 3

• http://aviv.raffon.net/2007/09/25/ReadyAIMFire.aspx · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-5124 · Nota de Segurança
• http://securityfocus.com/archive/1/480647/100/0/threaded · Nota