PT-2006-4144 · Microsoft · Windows Live Messenger

Published 2006-06-27 · Updated 2024-02-14 · CVE-2006-3250

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Medium

Base vector

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Windows Live Messenger version 8.0

Description A heap-based buffer overflow issue allows user-assisted attackers to execute arbitrary code via a crafted Contact List (.ctt) file. This overflow is triggered when the crafted file is imported by the user.

Recommendations For Windows Live Messenger version 8.0, avoid importing .ctt files from untrusted sources until a patch is available. As a temporary workaround, consider restricting the import of Contact List files to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2006-3250

Affected Products

Windows Live Messenger

References · 7

• 🔥 http://jaascois.com/exploits/18602016 · Exploit
• 🔥 http://securityfocus.com/bid/18639 · Exploit
• 🔥 http://securitytracker.com/id?1016373 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-3250 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27417 · Note
• http://securityfocus.com/archive/1/438442/100/0/threaded · Note
• http://securitydot.net/xpl/exploits/vulnerabilities/articles/1108/exploit.html · Note