MS07-054: Vulnerability in MSN Messenger and Windows Live Messenger Could Allow Remote Code Execution (942099)

High Nessus Plugin ID 26019


Arbitrary code can be executed on the remote host through Messenger service.


The remote host is running MSN Messenger or Windows Live Messenger.

The version of Messenger used on the remote host is vulnerable to a remote buffer overflow in the way it handles webcam and video chat sessions. An attacker may exploit this vulnerability to execute arbitrary code on the remote host.


Microsoft has released a set of patches for MSN Messenger 6.2, 7.0, 7.5 and 8.0.

See Also

Plugin Details

Severity: High

ID: 26019

File Name: smb_nt_ms07-054.nasl

Version: $Revision: 1.28 $

Type: local

Agent: windows

Published: 2007/09/11

Modified: 2017/08/10

Dependencies: 12091, 57033

Risk Information

Risk Factor: High


Base Score: 9.3

Temporal Score: 7.3

Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C

Temporal Vector: CVSS2#E:POC/RL:OF/RC:C

Vulnerability Information

CPE: cpe:/o:microsoft:windows

Required KB Items: SMB/MS_Bulletin_Checks/Possible

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2007/09/11

Vulnerability Publication Date: 2007/01/31

Reference Information

CVE: CVE-2007-2931

BID: 25461

OSVDB: 40126

MSFT: MS07-054

MSKB: 942099

CERT: 166521

EDB-ID: 30537

CWE: 20, 119