AOL Instant Messenger Escaped Character Entities DoS Vulnerability

Bugtraq ID:	1810
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	Yes
Published:	Mar 02 2000 12:00AM
Updated:	Mar 02 2000 12:00AM
Credit:	Posted to Bugtraq on March 2, 2000 by cruz <[email protected]>.
Vulnerable:	AOL Instant Messenger 3.5 .1808 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows NT 4.0 AOL Instant Messenger 3.5 .1670 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows NT 4.0 AOL Instant Messenger 3.5 .1635 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows NT 4.0 AOL Instant Messenger 3.0 N - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows NT 4.0 AOL Instant Messenger 3.0 .1470 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows NT 4.0 AOL Instant Messenger 2.5 .1598 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows NT 4.0 AOL Instant Messenger 2.5 .1366 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows NT 4.0 AOL Instant Messenger 2.0 N - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows NT 4.0
Not Vulnerable:

AOL Instant Messenger Escaped Character Entities DoS Vulnerability

Escaped character entities ranging from &#770 - &#779 sent to an AOL Instant Messenger client have varying effects ranging from closing of message windows to shutdown of the application. Attacks can be launched if URL references contain these particular entities. Restart of the application is required in order to regain normal functionality.

AOL Instant Messenger Escaped Character Entities DoS Vulnerability

See discussion.

AOL Instant Messenger Escaped Character Entities DoS Vulnerability

Solution:
AOL Instant Messenger 3.5.1856 and later versions are not susceptible to this vulnerability. The latest version can be downloaded at the following location:

http://www.aol.com/aim/home.html

AOL Instant Messenger Escaped Character Entities DoS Vulnerability

References:

• AOL Instant Messenger Home Page (AOL)