-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Aim on MAC OS X does not appear to be vulnerable. It gives a message complaining about screenname length. I can confirm that indeed all version of aim 4.3 - 4.8 are vulnerable (on windows). Regards, Leon - -----Original Message----- From: John Adair [mailto:J.Adairat_private] Sent: Thursday, March 07, 2002 1:34 PM To: vuln-devat_private Subject: RE: AIM including the beta 4.8.2646 Local/Remote Buffer Oveflow eSafe Gateway(tm) has scanned this mail for viruses, vandals and suspicious attachments and has found it to be CLEAN. File: smime.p7s (2,256 bytes) Encoding: Base64 Result: Clean. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ If anyone wants the dump file please e-mail me off list. I was able to overwrite the edi, but I am sure we can find more given enough research.vuln-devat_private I'm at work so I can't look into this issue too much, but here is what I found in a couple of minutes. I was able to craft my link to overwrite a few registers on the stack. I attached the dump I got from my first test. I used a larger buffer than what the advisory stated, but not much larger. On a side note, I had to reboot to get AIM to startup again and when I tried starting it up again (before the reboot) my machine froze. On another machine it crashed the entire system when Dr Watson was generating the dump file. - - - - Opinions expressed do not necessarily represent the views of my employer. This message and any attachment are confidential and may be privileged or otherwise protected from disclosure. If you are not the intended recipient, please telephone, fax or e-mail to the sender without delay. Return this message or delete this message and any attachment from your system as per our request. If you are not the intended recipient you must not copy this message or attachments or disclose the contents to any other person. -----BEGIN PGP SIGNATURE----- Version: PGPfreeware 6.5.8 for non-commercial use <http://www.pgp.com> iQA/AwUBPIr/stqAgf0xoaEuEQJdPgCg46n3xI9/M7qoLo0ujVgp1W/1QyIAnRFp iNKhiDHrvQxUrK86GL2XPuG8 =/0B6 -----END PGP SIGNATURE-----
This archive was generated by hypermail 2b30 : Sun Mar 10 2002 - 13:07:21 PST