Full Disclosure mailing list archives
AOL Instant Messenger Binary File Planting PoC
From: Marshall Whittaker <marshallwhittaker () gmail com>
Date: Sat, 6 Jul 2013 04:39:37 -0400
I came across a binary file planting vulnerability in AOL Instant Messenger (AIM) 8.0.1.5 on July 4th. There is a problem where by their ad code is not checked for validity, so you can inject whatever you want over the LAN and force it to download a .exe without any warning and drop it in "My Documents" on Windows XP and Windows 7. At this time, 8.0.1.5 is so far unpatched/unknown. Affected: AOL Instant Messenger <=8.0.1.5 (XP/7) Working proof of concept code is attached. Requires ettercap and msf. Enjoy, and hope you had a happy 4th!!! Marshall
Attachment:
aimJ4.sh
Description:
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- AOL Instant Messenger Binary File Planting PoC Marshall Whittaker (Jul 06)