The remote host is running AOL Instant Messenger (AIM). AIM is prone to an issue that may allow attackers to execute arbitrary files on the client system. It is possible to send a malicious link that references local files to a user of the client. When the link is visited, the referenced file on the client's local filesystem will be executed. To exploit this issue, the attacker must know the exact location of the file to be executed. Additionally, there can be no spaces in the path or filename. This limits exploitability, since files must be on the same partition and command line arguments cannot be supplied. Versions other than AOL Instant Messenger 4.8.2790 do not seem to be affected by this vulnerability.

The remote host is running AOL Instant Messenger (AIM). A vulnerability has been discovered in AIM that could allow an attacker to force a user to download an attacker supplied file. If a vulnerable user has an option enabled that allows users to download files without a prompt, it may be possible to force the user to download a file. The file will be transferred without prompting the target user for authorization.

The remote host is running Pidgin earlier than 2.5.6. Such versions are reportedly affected by multiple remote buffer overflow vulnerabilities : 

 - A buffer overflow issue in the 'decrypt_out()' function can be exploited through specially crafted 'QQ' packets. (CVE-2009-1374)

 - A buffer maintained by PurpleCircBuffer which is used by XMPP and Sametime protocol plugins can be corrupted if it's exactly full and then more bytes are added to it. (CVE-2009-1375)

 - A buffer overflow is possible when initiating a file transfer to a malicious buddy over XMPP. (CVE-2009-1373)

 - An integer-overflow issue exists in the application due to a n incorrect typecasting of 'int64' to 'size_t'. (CVE-2009-1376)

Successful exploitation could allow an attacker to execute arbitrary code on the remote host.

The remote host is a Jabber server.  Jabber is an open-source instant messaging server.

The version of Skype installed on the remote host is vulnerable to a flaw wherein specially formatted 'file://' URI will allow the download and execution of executable files.  An attacker, exploiting this flaw, would need to be able to coerce a user into browsing a malicious URI.  Successful exploitation would result in the attacker executing arbitrary code.

The version of Trillian installed on the remote host reportedly contains several vulnerabilities :

  - A stack buffer overflow in 'aim.dll' triggered when parsing messages with overly long attribute values within the 'FONT' tag.
  - A memory corruption issue within XML parsing in 'talk.dll' triggered when processing malformed attributes within an 'IMG' tag. 
  - A stack buffer overflow in the header-parsing code for the MSN protocol when processing the 'X-MMS-IM-FORMAT' header.

Successful exploitation of each issue can result in code execution subject to the privileges of the current user.

The remote host appears to be running Gaim, a popular open-source multi-protocol instant messenger. It is reported that this version of Gaim is prone to multiple vulnerabilities including several buffer and heap overflows. These vulnerabilities may permit an attacker to execute arbitrary code on the remote computer.

The remote host is running a vulnerable version of Bird Chat Server. Bird Chat Server is a small chat server for Windows. It is reported that versions up to 6.10 are prone to an issue that permit an attacker connecting with a fake username on the server to remotely crash all clients using the server.

ID	Name	Severity
1245	AOL Instant Messenger URL href Attribute Traversal Arbitrary Local File Execution	medium
1244	AOL Instant Messenger Arbitrary File Forced Download	high
5032	Pidgin < 2.5.6 Multiple Buffer Overflow Vulnerabilities	high
4571	Jabber Server Detection	info
4570	Jabber Client Detection	info
4531	Skype Technologies URI Handler Remote Code Execution	medium
4515	Trillian < 3.1.10.0 Multiple Vulnerabilities	high
2159	Gaim < 0.82 Multiple Overflows	medium
2135	Bird Chat Server Invalid User DoS	medium

Detections

Analytics

Internet Messengers Family for Nessus Network Monitor

medium

high

high

info

info

medium

high

medium

medium