PT-2007-6220 · Aol+1 · Aol Instant Messenger+1

Published 2007-09-27 · Updated 2018-10-15 · CVE-2007-5124

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions AOL Instant Messenger (AIM) versions 6.5.3.12 and earlier

Description The issue allows remote attackers to execute arbitrary code via unspecified web script or HTML in an instant message. This is related to AIM's filtering of specific tags and attributes and the lack of Local Machine Zone lockdown.

Recommendations For AOL Instant Messenger (AIM) versions 6.5.3.12 and earlier, consider disabling the embedded Internet Explorer server control as a temporary workaround until a patch is available. Restrict the use of instant messaging features that may process web scripts or HTML to minimize the risk of exploitation.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2007-5124

Affected Products

Aol Instant Messenger

Internet Explorer

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2007-5124 · Security Note
• http://aviv.raffon.net/2007/09/25/ReadyAIMFire.aspx · Note
• http://securityfocus.com/archive/1/480647/100/0/threaded · Note