CVE-2007-4901
First published: Fri Sep 14 2007(Updated: )
The embedded Internet Explorer server control in AOL Instant Messenger (AIM) 6.1.41.2 and 6.2.32.1, AIM Pro, and AIM Lite does not properly constrain the use of mshtml.dll's web script and HTML functionality for incoming instant messages, which allows remote attackers to place HTML into unexpected contexts or execute arbitrary code, as demonstrated by writing arbitrary HTML to a notification window, and writing contents of arbitrary local image files to this window via IMG SRC.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| AOL Instant Messenger Lite | ||
| AOL AIM Triton | ||
| AOL Instant Messenger | =6.2.32.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://aviv.raffon.net/2007/09/25/ReadyAIMFire.aspx
- http://www.coresecurity.com/index.php5?module=ContentMod&action=item&id=1924
- http://www.securityfocus.com/bid/25659
- http://secunia.com/advisories/26786
- http://securityreason.com/securityalert/3136
- http://www.securityfocus.com/archive/1/480647/100/0/threaded
- http://www.securityfocus.com/archive/1/480587/100/0/threaded
- http://www.securityfocus.com/archive/1/479435/100/0/threaded
- http://www.securityfocus.com/archive/1/479199/100/0/threaded
Frequently Asked Questions
What is the severity of CVE-2007-4901?
CVE-2007-4901 is considered a high severity vulnerability due to its potential for remote code execution.
How do I fix CVE-2007-4901?
To address CVE-2007-4901, users should update their AOL Instant Messenger to the latest version or uninstall affected versions.
What software is affected by CVE-2007-4901?
CVE-2007-4901 affects AOL Instant Messenger versions 6.1.41.2, 6.2.32.1, AIM Pro, and AIM Lite.
What type of vulnerability is CVE-2007-4901?
CVE-2007-4901 is classified as a remote code execution vulnerability stemming from improper constraints in handling HTML and script functionality.
Can CVE-2007-4901 be exploited remotely?
Yes, CVE-2007-4901 can be exploited remotely by attackers sending specially crafted messages to affected users.
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/severity
- agent/last-modified-date
- agent/references
- agent/author
- agent/event
- agent/description
- agent/first-publish-date
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-historical
- vendor/aol
- canonical/aol instant messenger lite
- canonical/aol aim triton
- canonical/aol instant messenger
- version/aol instant messenger/6.2.32.1