AIM Arbitrary HTML Display in Notification Window

To: bugtraq@xxxxxxxxxxxxxxxxx
Subject: AIM Arbitrary HTML Display in Notification Window
From: shell@xxxxxxxxxxxx
Date: Tue, 11 Sep 2007 20:16:38 -0500 (CDT)
Importance: Normal
List-help: <mailto:bugtraq-help@securityfocus.com>
List-id: <bugtraq.list-id.securityfocus.com>
List-post: <mailto:bugtraq@securityfocus.com>
List-subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
List-unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
Mailing-list: contact bugtraq-help@xxxxxxxxxxxxxxxxx; run by ezmlm
User-agent: SquirrelMail/1.4.9a

Arbitrary HTML can be readily displayed in notification windows generated
by AOL Instant Messenger when the window of origin is not the main focus.
This vulnerability is known to be present at least in version 6.1.41.2
(which is the current release). It appears to display any form of
HTML-compliant code. More details can be provided on request.

Discovery credited to:
Shell ( dotshell.net, shell6@xxxxxxxxx, shell@xxxxxxxxxxxx)
Lone (Lone-Matrix.com, Lone@xxxxxxxxxxxxxxx )

Prev by Date: SYMSA-2007-008: Autodesk Backburner 3.0.2 System Backdoor
Next by Date: CAL-20070912-1 Multiple vendor produce handling AVI file vulnerabilities
Previous by thread: SYMSA-2007-008: Autodesk Backburner 3.0.2 System Backdoor
Next by thread: CAL-20070912-1 Multiple vendor produce handling AVI file vulnerabilities
Index(es):
- Date
- Thread