AOL Instant Messenger SIP Invite Message Denial of Service Vulnerability

Bugtraq ID:	24533
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2007-3350
Remote:	Yes
Local:	No
Published:	Jun 19 2007 12:00AM
Updated:	May 07 2015 05:37PM
Credit:	Sipera VIPER Lab is credited with the discovery of this vulnerability.
Vulnerable:	AOL Instant Messenger 6.1.32.1
Not Vulnerable:

AOL Instant Messenger SIP Invite Message Denial of Service Vulnerability

AOL Instant Messenger is prone to a denial-of-service vulnerability because the application fails to handle specially crafted SIP messages.

An attacker can exploit this issue to crash the affected application, denying service to legitimate users.

This issue affects AOL Instant Messenger 6.1.32.1; prior versions may also be affected.

AOL Instant Messenger SIP Invite Message Denial of Service Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

AOL Instant Messenger SIP Invite Message Denial of Service Vulnerability

Solution:
The vendor released a patch to address this issue. Please see the references for more information.


AOL Instant Messenger 6.1.32.1

• AOL Install_AIM.exe
  http://http303.edge.ru4.com/smartserve/ttplus?placement=tp-0028-151&ta rget=http://download.newaol.com/aim/win95/Install_AIM.exe

AOL Instant Messenger SIP Invite Message Denial of Service Vulnerability

References:

• AOL Instant Messenger crashes when processing a specially crafted SIP (Sipera Systems)
  
• AOL Instant Messenger Home Page (AOL)