Summary
Detail | |||
---|---|---|---|
Vendor | Microsoft | First view | 2002-05-16 |
Product | Msn Messenger | Last view | 2007-08-31 |
Version | 6.2 | Type | |
Update | |||
Edition | |||
Language | |||
Sofware Edition | |||
Target Software | |||
Target Hardware | |||
Other |
Activity : Overall
COMMON PLATFORM ENUMERATION: Repartition per Version
Related : CVE
Date | Alert | Description | |
---|---|---|---|
9.3 | 2007-08-31 | CVE-2007-2931 | Heap-based buffer overflow in Microsoft MSN Messenger 6.2, 7.0, and 7.5, and Live Messenger 8.0 allows user-assisted remote attackers to execute arbitrary code via unspecified vectors involving video conversation handling in Web Cam and video chat sessions. |
5 | 2007-06-26 | CVE-2007-3436 | Microsoft MSN Messenger 4.7 on Windows XP allows remote attackers to cause a denial of service (resource consumption) via a flood of SIP INVITE requests to the port specified for voice conversation. |
2.1 | 2006-01-22 | CVE-2006-0363 | The "Remember my Password" feature in MSN Messenger 7.5 stores passwords in an encrypted format under the HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Creds registry key, which might allow local users to obtain the original passwords via a program that calls CryptUnprotectData, as demonstrated by the "MSN Password Recovery.exe" program. NOTE: it could be argued that local-only password recovery is inherently insecure because the decryption methods and keys must be stored somewhere on the local system, and are thus inherently accessible with varying degrees of effort. Perhaps this issue should not be included in CVE. |
7.5 | 2005-04-12 | CVE-2005-0562 | GIF file validation error in MSN Messenger 6.2 allows remote attackers in a user's contact list to execute arbitrary code via a GIF image with an improper height and width. |
10 | 2004-11-23 | CVE-2004-0597 | Multiple buffer overflows in libpng 1.2.5 and earlier, as used in multiple products, allow remote attackers to execute arbitrary code via malformed PNG images in which (1) the png_handle_tRNS function does not properly validate the length of transparency chunk (tRNS) data, or the (2) png_handle_sBIT or (3) png_handle_hIST functions do not perform sufficient bounds checking. |
5 | 2004-04-15 | CVE-2004-0122 | Microsoft MSN Messenger 6.0 and 6.1 does not properly handle certain requests, which allows remote attackers to read arbitrary files. |
5 | 2002-12-31 | CVE-2002-1831 | Microsoft MSN Messenger Service 1.0 through 4.6 allows remote attackers to cause a denial of service (crash) via an invite request that contains hex-encoded spaces (%20) in the Invitation-Cookie field. |
5 | 2002-12-31 | CVE-2002-1698 | Buffer overflow in Microsoft MSN Messenger Service 1.0 through 4.6 allows remote attackers to cause a denial of service (crash) via a long FN (font) argument in the message header. |
5 | 2002-08-12 | CVE-2002-0472 | MSN Messenger Service 3.6, and possibly other versions, uses weak authentication when exchanging messages between clients, which allows remote attackers to spoof messages from other users. |
7.5 | 2002-05-29 | CVE-2002-0155 | Buffer overflow in Microsoft MSN Chat ActiveX Control, as used in MSN Messenger 4.5 and 4.6, and Exchange Instant Messenger 4.5 and 4.6, allows remote attackers to execute arbitrary code via a long ResDLL parameter in the MSNChat OCX. |
5 | 2002-05-16 | CVE-2002-0228 | Microsoft MSN Messenger allows remote attackers to use Javascript that references an ActiveX object to obtain sensitive information such as display names and web site navigation, and possibly more when the user is connected to certain Microsoft sites (or DNS-spoofed sites). |
CWE : Common Weakness Enumeration
% | id | Name |
---|---|---|
50% (1) | CWE-119 | Failure to Constrain Operations within the Bounds of a Memory Buffer |
50% (1) | CWE-20 | Improper Input Validation |
CAPEC : Common Attack Pattern Enumeration & Classification
id | Name |
---|---|
CAPEC-64 | Using Slashes and URL Encoding Combined to Bypass Validation Logic |
CAPEC-72 | URL Encoding |
Oval Markup Language : Definitions
OvalID | Name |
---|---|
oval:org.mitre.oval:def:844 | MSN Messenger Remote File Access Vulnerability |
oval:org.mitre.oval:def:7709 | libpng buffer overflow |
oval:org.mitre.oval:def:594 | Windows Messenger 6 libpng Buffer Overflow |
oval:org.mitre.oval:def:4492 | Adobe Acrobat Reader libpng Buffer Overflow |
oval:org.mitre.oval:def:2378 | Multiple Buffer Overflows in libpng |
oval:org.mitre.oval:def:2274 | Windows Messenger 5 libpng Buffer Overflow |
oval:org.mitre.oval:def:11284 | Multiple buffer overflows in libpng 1.2.5 and earlier, as used in multiple pr... |
oval:org.mitre.oval:def:4927 | MSN Messenger GIF Size Buffer Overflow |
oval:org.mitre.oval:def:2063 | Vulnerability in MSN Messenger and Windows Live Messenger Could Allow Remote ... |
Open Source Vulnerability Database (OSVDB)
id | Description |
---|---|
60410 | MSN Messenger Remember my Password Feature Registry Encrypted Password Local ... |
59664 | MSN Messenger Service Invite Request Feature Invitation-Cookie Parameter Remo... |
45427 | MSN Messenger SIP INVITE Saturation Remote Resource Consumption DoS |
40126 | MSN Messenger Video Conversation Handling Remote Overflow |
21560 | MSN Messenger Message Header FN Field Overflow DoS |
15468 | MSN Messenger Malformed GIF Code Execution |
10981 | MSN Messenger ActiveX Object Javascript Reference Information Disclosure |
10426 | MSN Messenger Service Weak Encryption Message Spoofing |
8326 | libpng png_handle_tRNS Remote Overflow |
8312 | libpng png_handle_sBIT() Local Overflow |
5355 | Microsoft MSN Chat ActiveX ResDLL Parameter Overflow |
4169 | MSN Messenger Arbitrary File Retrieval |
OpenVAS Exploits
id | Description |
---|---|
2010-04-30 | Name : Mandriva Update for pidgin MDVSA-2010:085 (pidgin) File : nvt/gb_mandriva_MDVSA_2010_085.nasl |
2010-01-15 | Name : Mandriva Update for pidgin MDVSA-2010:001 (pidgin) File : nvt/gb_mandriva_MDVSA_2010_001.nasl |
2010-01-15 | Name : Mandriva Update for pidgin MDVSA-2010:002 (pidgin) File : nvt/gb_mandriva_MDVSA_2010_002.nasl |
2008-09-24 | Name : Gentoo Security Advisory GLSA 200408-03 (libpng) File : nvt/glsa_200408_03.nasl |
2008-09-24 | Name : Gentoo Security Advisory GLSA 200408-22 (mozilla) File : nvt/glsa_200408_22.nasl |
2008-09-04 | Name : FreeBSD Ports: ImageMagick, ImageMagick-nox11 File : nvt/freebsd_ImageMagick3.nasl |
2008-09-04 | Name : FreeBSD Ports: png File : nvt/freebsd_png.nasl |
2008-01-17 | Name : Debian Security Advisory DSA 536-1 (libpng) File : nvt/deb_536_1.nasl |
2006-03-26 | Name : Windows Messenger is installed File : nvt/winmessenger_installed.nasl |
0000-00-00 | Name : Slackware Advisory SSA:2004-222-01 libpng File : nvt/esoft_slk_ssa_2004_222_01.nasl |
0000-00-00 | Name : Slackware Advisory SSA:2004-223-01 Mozilla File : nvt/esoft_slk_ssa_2004_223_01.nasl |
0000-00-00 | Name : Slackware Advisory SSA:2004-223-02 imagemagick File : nvt/esoft_slk_ssa_2004_223_02.nasl |
Snort® IPS/IDS
Date | Description |
---|---|
2014-01-10 | Microsoft MSN Chat v4.5, 4.6 ActiveX object access RuleID : 4182 - Type : BROWSER-PLUGINS - Revision : 12 |
2014-01-10 | libpng tRNS overflow attempt RuleID : 2673-community - Type : FILE-IMAGE - Revision : 12 |
2014-01-10 | libpng tRNS overflow attempt RuleID : 2673 - Type : FILE-IMAGE - Revision : 12 |
2014-01-10 | Microsoft MSN Messenger and Windows Live Messenger Code Execution attempt RuleID : 20554 - Type : PUA-OTHER - Revision : 10 |
2014-01-10 | Microsoft MSN Messenger and Windows Live Messenger Code Execution attempt RuleID : 17551 - Type : PUA-OTHER - Revision : 11 |
Nessus® Vulnerability Scanner
id | Description |
---|---|
2010-07-30 | Name: The remote Mandriva Linux host is missing one or more security updates. File: mandriva_MDVSA-2010-002.nasl - Type: ACT_GATHER_INFO |
2010-04-29 | Name: The remote Mandriva Linux host is missing one or more security updates. File: mandriva_MDVSA-2010-085.nasl - Type: ACT_GATHER_INFO |
2010-01-12 | Name: The remote Mandriva Linux host is missing one or more security updates. File: mandriva_MDVSA-2010-001.nasl - Type: ACT_GATHER_INFO |
2009-04-23 | Name: The remote FreeBSD host is missing one or more security-related updates. File: freebsd_pkg_f9e3e60be65011d89b0a000347a4fa7d.nasl - Type: ACT_GATHER_INFO |
2007-09-11 | Name: Arbitrary code can be executed on the remote host through Messenger service. File: smb_nt_ms07-054.nasl - Type: ACT_GATHER_INFO |
2007-02-18 | Name: The remote Mandrake Linux host is missing one or more security updates. File: mandrake_MDKSA-2006-213.nasl - Type: ACT_GATHER_INFO |
2007-02-18 | Name: The remote Mandrake Linux host is missing a security update. File: mandrake_MDKSA-2006-212.nasl - Type: ACT_GATHER_INFO |
2005-07-13 | Name: The remote Slackware host is missing a security update. File: Slackware_SSA_2004-223-01.nasl - Type: ACT_GATHER_INFO |
2005-07-13 | Name: The remote Slackware host is missing a security update. File: Slackware_SSA_2004-223-02.nasl - Type: ACT_GATHER_INFO |
2005-07-13 | Name: The remote Slackware host is missing a security update. File: Slackware_SSA_2004-222-01.nasl - Type: ACT_GATHER_INFO |
2005-04-12 | Name: Arbitrary code can be executed on the remote host through Messenger service. File: smb_nt_ms05-022.nasl - Type: ACT_GATHER_INFO |
2005-02-08 | Name: Arbitrary code can be executed on the remote host through the Media Player. File: smb_nt_ms05-009.nasl - Type: ACT_GATHER_INFO |
2004-09-29 | Name: The remote Debian host is missing a security-related update. File: debian_DSA-536.nasl - Type: ACT_GATHER_INFO |
2004-08-30 | Name: The remote Gentoo host is missing one or more security-related patches. File: gentoo_GLSA-200408-03.nasl - Type: ACT_GATHER_INFO |
2004-08-30 | Name: The remote Gentoo host is missing one or more security-related patches. File: gentoo_GLSA-200408-22.nasl - Type: ACT_GATHER_INFO |
2004-08-22 | Name: The remote Mandrake Linux host is missing one or more security updates. File: mandrake_MDKSA-2004-079.nasl - Type: ACT_GATHER_INFO |
2004-08-22 | Name: The remote Mandrake Linux host is missing one or more security updates. File: mandrake_MDKSA-2004-082.nasl - Type: ACT_GATHER_INFO |
2004-08-10 | Name: The remote host is missing a Mac OS X update that fixes a security issue. File: macosx_SecUpd20040809.nasl - Type: ACT_GATHER_INFO |
2004-08-05 | Name: The remote Fedora Core host is missing a security update. File: fedora_2004-239.nasl - Type: ACT_GATHER_INFO |
2004-08-05 | Name: The remote Red Hat host is missing one or more security updates. File: redhat-RHSA-2004-402.nasl - Type: ACT_GATHER_INFO |
2004-08-05 | Name: The remote Red Hat host is missing one or more security updates. File: redhat-RHSA-2004-421.nasl - Type: ACT_GATHER_INFO |
2004-08-05 | Name: The remote Fedora Core host is missing a security update. File: fedora_2004-238.nasl - Type: ACT_GATHER_INFO |
2004-08-05 | Name: The remote Fedora Core host is missing a security update. File: fedora_2004-237.nasl - Type: ACT_GATHER_INFO |
2004-08-05 | Name: The remote Fedora Core host is missing a security update. File: fedora_2004-236.nasl - Type: ACT_GATHER_INFO |
2004-08-04 | Name: The remote host is missing a vendor-supplied security patch File: suse_SA_2004_023.nasl - Type: ACT_GATHER_INFO |