Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email email@example.com
Re: AOL Instant Messenger Version 5.9.3861 Local Buffer Overrun Vulnerability
From: Stan Bubrouski (stan.bubrouskigmail.com)
Date: Sat Feb 04 2006 - 12:10:36 CST
On the other hand I can't seem to reproduce the below-mentioned bug
either on win2k up2date with AIM 5.9.3861.
On 3 Feb 2006 02:28:56 -0000, shelldotshell.net <shelldotshell.net> wrote:
> As I submitted to full disclosure:
> "I have discovered that there is a buffer overrun vulnerability in AOL's Instant Messenger program. I have only tested this on version 5.9.3861. The problem causes a minimum of a program crash. I am not sure as to the posibility of shellcode execution.
> The vulnerability can be exploited by supplying an overly large username from which to obtain "buddy info."
> If you are unsure as to what I am talking about, I can post a screenshot."
> Well, I made a Macromedia Captivate-made video of it. http://www.dotshell.net/aim.swf. What I am thinking is that a program can be written to write an overlong string and shellcode to the address effected and execute the same operation to leverage the problem.