Traffic observed from the remote host indicates Slack Chat has been accessed.

The remote host is running a vulnerable version of Pidgin chat client.  This version of Pidgin is vulnerable to multiple flaws which would allow an attacker to read/write arbitrary data, subvert security tokens, cause a denial of service, and more.

The remote host is running the Pidgin chat client.

The remote system is utilizing a popular Chat application.

 The remote system is utilizing the Viber Client, a chat client that allows users to make free calls and send free texts, photos and video messages to other Viber users. Predominantly used on the mobile platform, it can also be used from the desktop.

The remote server is utilizing the KakaoTalk mobile application. In addition to basic messaging, the KakaoTalk mobile application provides capabilities to send images, videos, and audio messages, as well as make free VoIP phone calls.

The remote device is utilizing a Kakao application. Kakao applications provide capabilities to send multimedia messages, make free VoIP phone calls, hail taxis, and perform many other tasks.

The remote server is utilizing the WhatsApp Client.  WhatsApp is a chat/p2p client which is free for most major mobile phones.

The remote host is running the LINE chat client. In addition to basic messaging, the LINE application provides capabilities to send images, videos, and audio messages, as well as make free VoIP phone calls.

The remote host is running the WeChat Chat application.  WeChat is a mobile text and voice messaging application.

The remote host is accessing the Meebo Messenger web application.

The remote host is running a Yahoo Instant Messenger client.

The remote host is using the Skype program, a peer to peer chat and VoIP software.

The version of Skype installed on the remote host is earlier than 4.2.0.155.  Such versions are potentially affected by a flaw in the handling of specially crafted 'skype: ' URIs.  An attacker, exploiting this flaw, could control certain Skype settings and possibly gain access to sensitive information.

The remote host is running Pidgin &lt; 2.6.5.  Such versions are potentially affected by an information disclosure vulnerability because the MSN protocol plugin axtracts the filename of a custom emoticon from an incoming request and uploads that file without correlating the filename to a valid custom emoticon.

The remote host is running Pidgin &lt; 2.6.1. Such versions are potentially affected by multiple issues : 

  - A denial-of-service vulnerability because it fails to properly handle malformed links sent via the Yahoo Instant Messenger protocol. (CVE-2009-3025)

  - A man-in-the-middle vulnerability exists because the application does not require the TLS/SSL preference to be enabled when connecting to older Jabber servers. (CVE-2009-3026)

The remote host is running Pidgin 2.5.9.  Such versions reportedly trigger an memcpy to an invalid location in memory when receiving two consecutive specially crafted SLP message.

The version of Trillian installed on the remote host reportedly contains several vulnerabilities : 

  - A stack buffer overflow in the tool tip processing code could allow an unauthenticated attacker to execute arbitrary code with client privileges on the remote system. (ZDI-08-077)

  - A vulnerability in the XML processing code responsible for handling specially formulated XML could lead to arbitrary code execution on the remote system. (ZDI-08-078)

  - A vulnerability in XML processing code responsible for handling malformed XML tags could lead to arbitrary code execution on the remote system. (ZDI-08-079)

The remote host is an ICQ client.  ICQ is a messaging software that is used for chat, file exchange and more.
This version is reported to be vulnerable to a remote format string overflow.  An attacker exploiting this flaw would need to be able to convince a user to open a specially formatted message.  Successful exploitation would result in the attacker executing arbitrary code on the target machine.

The remote host is an ICQ client.  ICQ is a messaging software that is used for chat, file exchange and more.

The version of Skype installed on the remote host is vulnerable to a heap overflow vulnerability in the skype4com URI handler.  A remote attacker would  have to convince a user to click on a specially-crafted Skype URL to exploit this flaw.

The Trillian chat client is installed on the remote client. Trillian is a chat client that can be used for messaging and file transfer.

The remote client is running AOL Instant Messenger.
This version of AIM is vulnerable to a flaw where script code can be injected and executed by a malicious user.  To exploit this flaw, an attacker would only need to be able to send a message to an unsuspecting user.  Successful exploitation would result in the attacker executing arbitrary script code.

The remote host is running MSN Messenger or Windows Live Messenger.  The version of Messenger used on the remote host is vulnerable to a remote buffer overflow in the way it handles webcam and video chat sessions.  An attacker may exploit this vulnerability to execute arbitrary code on the remote host.

The remote host contains the 'YVerInfo' ActiveX control, distributed as part of the Yahoo! services suite typically downloaded with the installer for Yahoo! Messenger.  The version of this control installed on the remote host reportedly contains a boundary error.  If an attacker can trick a user on the affected host into visiting a specially-crafted web page, he may be able to leverage this issue to execute arbitrary code on the host subject to the user's privileges.

The remote host is running Windows Live Messenger.

This version of Windows Live Messenger is vulnerable to a flaw in the way that it processes video messages.  An attacker exploiting this flaw would need to be able to initiate a chat session with a user running a vulnerable version of the software.  Successful exploitation would result in the attacker executing arbitrary code.

The remote host is running Windows Live Messenger.

The remote client is utilizing the 'AIMExpress' service.  AIMExpress allows users to utilize a chat client (AOL Instant Messenger) via a web browser.

The version of Trillian installed on the remote host reportedly is affected by a buffer overflow issue involving improper handling of 'aim:' URI strings.  A remote attacker may be able to leverage these issues to execute arbitrary code as the current user.

The remote client is running AOL Instant Messenger.

The remote host is running AOL Instant Messenger (AIM).  Versions 6.1.32.1 and lower are reported vulnerable to a remote Denial of Service (DoS) attack.  An attacker exploiting this flaw would only need to be able to initiate a SIP session to the AIM client.  Successful exploitation would result in the Instant Messenger client crashing.

The version of Trillian installed on the remote host reportedly is affected by a heap buffer overflow issue involving improper handling of UTF-8 sequences when word-wrapping UTF-8 text.  A remote attacker may be able to leverage these issues to execute arbitrary code as the current user.

The remote client is running Windows Live Messenger, an application that allows users to chat and share information on multiple chat networks simultaneously.

The version of Trillian installed on the remote host reportedly contains several buffer overflow issues involving its handling of UTF-8 characters.  A remote attacker may be able to leverage these issues to execute arbitrary code as the current user.

The remote host is running MySpaceIM, an application that allows MySpace users to chat with one another.

The remote host is using Skype, a peer to peer chat and VoIP software. The remote version of this software contains a format string flaw.  An attacker exploiting this flaw would need to be able to convince a user to open a malicious URI that was handled by the Skype software.  Successful exploitation would result in the attacker executing arbitrary code.

The remote host is running a version of Yahoo! Messenger that is reported vulnerable to a remote file extension spoofing flaw.  Specifically, if a user sends a malformed download query that includes many '~@' sequences, the displayed name of the file will obfuscate the true file type.  An attacker can use this flaw to trick users into downloading files that they believe are not malicious.  Successful exploitation might lead to the attacker executing arbitrary executables on the target system.

The remote host is running a version of Yahoo! Messenger that is reported vulnerable to a remote overflow.  An attacker exploiting this flaw would craft a malicious message that included non-ASCII characters.  The attacker would then send the malformed message to another Yahoo! Messenger user.  When the user received the malicious message, the overflow would be triggered and the application would crash.  In addition, the remote client is vulnerable to a flaw where remote users can initiate a browser connection by sending a malformed string to the Yahoo! Messenger Client.

The remote host is using Skype, a peer-to-peer chat and VoIP software. The remote version of this software contains a flaw where a Skype client, previously configured to allow downloads, will allow remote attackers to download arbitrary files from the local file system.  This can allow attackers to gain access to confidential data that may be useful for more sophisticated attacks.

The remote host is using Skype, a peer-to-peer chat and VoIP software. The remote version of this software contains multiple flaws that would allow an attacker to overflow memory buffers and either cause the service to stop or execute arbitrary code.

The remote host is running IndiaTimes Instant Messaging client.  IndiaTimes allows users to consolidate ICQ, Yahoo, AIM and MSN messengers into a single GUI console.  This version of IndiaTimes is vulnerable to a remote buffer overflow.  An attacker exploiting this flaw would need to be able to convince a user to browse to a malicious website and execute a malicious ActiveX control.  Successful exploitation would lead to the attacker executing arbitrary code on the remote system.

The remote host seems to be running Gaim, a popular open-source, multi-protocol instant messenger. It is reported that this version of Gaim is vulnerable to several remote flaws.  An attacker exploiting these flaws would be able to create a Denial of Service (DoS) condition or possibly overflow system memory and execute arbitrary code.

The remote host is using Skype, a peer to peer chat and VoIP software. The remote version of this software contains a security issue that may allow a local attacker to overwrite sensitive data files.  Successful exploitation would result in loss of confidential data or possibly a Denial of Service (DoS).

The remote host appears to be running Gaim, a popular open-source, multi-protocol instant messenger. It is reported that this version of Gaim is vulnerable to several remote flaws.  Namely

1) A Gaim client downloading a non-Ascii support file will crash when processing the file
2) The Gaim MSN Messenger module, when processing a malformed message, will crash.

Both of these vulnerabilities are Denial of Service (DoS) attacks that introduce a risk to availability.

The remote host is running AOL Instant Messenger (AIM).  Versions 5.9.3797 and lower are reported vulnerable to a remote Denial of Service (DoS) attack.  An attacker exploiting this flaw would only need to be able to initiate an GIF image exchange with a vulnerable AOL IM client.  Successful exploitation would result in the Instant Messenger client crashing.

The remote host appears to be running Gaim, a popular open-source, multi-protocol instant messenger. It is reported that this version of Gaim is vulnerable to several remote flaws.  Namely

1) The MSN protocol module is vulnerable to a remote Denial of Service (DoS) attack when sent a NULL SLP message.  Successful exploitation results in the application crashing.

2) Gaim instant messages support the sending of links (URIs).  This version of Gaim only supports links of 8192 bytes or less.  An attacker sending a link of more than 8192 bytes can overwrite memory and execute arbitrary code.

The remote host is running AOL Instant Messenger (AIM).  Versions 5.9.3702 and lower are reported to be vulnerable to a remote Denial of Service (DoS) attack.  An attacker exploiting this flaw would only need to be able to initiate a chat, file transfer, or game request to a vulnerable instance of AOL IM.  Successful exploitation would result in the Instant Messenger client crashing.

The remote host is running Microsoft MSN Messenger.  There is a flaw in this version of MSN Messenger that would allow a remote attacker to potentially execute code on the target host.  The flaw is in the processing of GIF images.  An attacker exploiting this flaw would need to be able to convince a user to view a GIF image (such as an emoticon or icon).  Successful exploitation would lead to arbitrary code being executed on the vulnerable system.

The remote host seems to be running Gaim, a popular open-source multi-protocol instant messenger. It is reported that this version of Gaim is prone to a flaw in the way that it handles malformed HTML data.  Specifically, a content-parsing flaw in the 'gaim_markup_strip_html' function can cause the application to fail, leading to a loss of availability.  Further, there are reported flaws within the IRC and Jabber plugins that can lead to a remote Denial of Service.  In addition, it is reported that a flaw within the IRC plugin can allow the injection of Gaim scripting language commands.

The remote host is running Trillian, a chat client.  This version of Trillian is reported vulnerable to a remote overflow.  While the details of the vulnerability are not known, the security risk is either a denial of service (availability) or remote code execution (integrity).

ID	Name	Severity
9606	Slack Chat Detection via UDP	Info
8575	Pidgin < 2.10.10	Medium
8574	Pidgin Client Detection	Info
6944	Viber Client Detection	Info
6941	KakaoTalk Mobile Application Detection	Info
6940	Kakao Mobile Application Detection	Info
6938	WhatsApp Client Detection	Info
6923	LINE Chat Client Detection	Info
6921	WeChat Mobile Application Detection	Info
6234	Meebo Messenger Detected	Info
5980	Yahoo! Messenger Detection	Info
5898	Skype Detection (User-Agent) (deprecated)	Low
5362	Skype < 4.2.0.155 URI Handler Security Vulnerability	Medium
5298	Pidgin < 2.6.5 Information Disclosure Vulnerability	Medium
5168	Pidgin < 2.6.1 Multiple Vulnerabilities	Medium
5137	Pidgin < 2.5.9 Buffer Overflow	High
4778	Trillian < 3.1.12.0 Multiple Vulnerabilities	High
4405	ICQ 6 HTML Code Generation Remote Format String	High
4404	ICQ 6 Version Detection	Info
4310	Skype Technologies < 3.6.0.216 skype4com URI Handler Remote Heap Corruption	Medium
4280	Trillian Version Detection	Info
4215	AOL Instant Messenger <= 6.1.41.2 Control Notification Window Script Injection	Medium
4211	Microsoft MSN Messenger and Windows Live Messenger Remote Code Execution Vulnerability (942099) (deprecated)	High
4210	Microsoft MSN Messenger and Windows Live Messenger Remote Code Execution Vulnerability (942099) (deprecated)	High
4199	Yahoo! Messenger < 8.1.0.419 YVerInfo ActiveX Buffer Overflow	Medium
4197	Windows Live Messenger < 8.1.0178 Video Processing Overflow	Medium
4196	Windows Live Messenger Version Detection (deprecated)	Info
4159	AIM Express Client Detection	Info
4144	Trillian < 3.1.7.0 Multiple Vulnerabilities	Medium
4104	AOL Instant Messenger 6 Version Detection	Info
4103	AOL Instant Messenger <= 6.1.32.1 SIP INVITE Message DoS	Low
4102	Trillian < 3.1.6.0 Multiple Vulnerabilities	Medium
4084	Windows Live Messenger Version Detection	Info
3977	Trillian < 3.1.5.0 Multiple Vulnerabilities	Medium
3939	MySpaceIM Chat Detection	Info
3772	Skype Technologies < 1.5.0.80 NSRRunAlertPanel Function Format String (Mac OS X) (deprecated)	High
3700	Yahoo! Messenger < 8.0.0.863 File Extension Spoofing	Medium
3665	Yahoo! Messenger <= 7.5.0.184 Multiple Vulnerabilities	Low
3627	Skype Technologies < 2.5.0.78 Arbitrary File Download	Low
3268	Skype Technologies Multiple Buffer Overflows	Critical
3199	IndiaTimes Instant Messenger ActiveX RenameGroup Function Overflow	Medium
3160	Gaim < 1.3.2 Multiple Vulnerabilities	Low
3070	Skype Temporary File Arbitrary File Overwrite	Medium
3012	Gaim < 1.3.1 Multiple Vulnerabilities	Medium
3008	AOL Instant Messenger Remote Malformed GIF DoS	High
2894	Gaim < 1.3.0 Multiple Vulnerabilities	Medium
2888	AOL Instant Messenger Font Tag sml Parameter Remote DoS	Medium
2817	MSN Messenger Malformed GIF Remote Overflow (deprecated)	High
2793	Gaim < 1.2.1 Multiple Vulnerabilities	Medium
2749	Trillian HTTP-parsing Remote Overflow	High

Internet Messengers Family for Nessus Network Monitor