(PVS) Signatures - Tenable Network Security

Description: Synopsis :\n\nThe remote host is vulnerable to a buffer overflow\n\nThe remote host is
running AOL Instant Messenger (AIM). Version prior to and including 4.3.2229 contain
buffer overflows in the code that processes AIM URLs. URLs containing "aim://" along
with exceptionally long goim and screenname parameter strings may crash a remote AIM
client provided the victim clicks on the link. A victim does NOT have to be running AIM
for a remote attacker to exploit this vulnerability.
Solution: Upgrade to the latest version of AOL Instant Messenger.
CVE-2000-1093
AOL Instant Messenger Filename Handling Format String
PVS ID: 1254 FAMILY: Internet Messengers
RISK:
MEDIUM
NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote host is vulnerable to format string flaw\n\nThe remote host is
running AOL Instant Messenger (AIM). Version 4.1.2010 of AIM is vulnerable to a format
string attack that may exploited by an attacker to crash a victim's IM client, leading to a
denial of service. The vulnerability lies in AIM's improper handling of file transfers of
filenames containing "%s".
Solution: Upgrade to the latest version of AOL Instant Messenger.
CVE-2000-1000
AOL Instant Messenger File Transfer Path Disclosure
PVS ID: 1255 FAMILY: Internet Messengers
RISK:
MEDIUM
NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote client may reveal file path information\n\nThe remote host is
running AOL Instant Messenger (AIM). Version 4.0 of AIM reveals the full pathname of
transferred files. This information could be used to leverage further attacks against the
client's machine.
Solution: Upgrade to the latest version of AOL Instant Messenger.
CVE-2000-0383
AOL Instant Messenger Malformed ASCII Value Message DoS
PVS ID: 1256 FAMILY: Internet Messengers
Passive Vulnerability Scanner (PVS) Signatures
RISK:
MEDIUM
NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote host is vulnerable to a denial of service (DoS) attack\n\nThe
remote host is running AOL Instant Messenger (AIM). Versions prior to and including 3.5
of AIM do not properly handle coded ASCII symbols (&#XXX format) where XXX is a
number greater than 255. AIM may crash if such a symbol is encountered resulting in a
denial of service attack.
Family Internet Services 320