Visit our newest sister site!
Hundreds of free aircraft flight manuals
Civilian • Historical • Military • Declassified • FREE!

TUCoPS :: Windows Net Apps :: aol40-~1.txt

Crashing the AOL 4.x Software

Date: Sat, 10 Oct 1998 19:31:59 PDT
From: HIGH TIMES <hight1mez@HOTMAIL.COM>

The A-TEAM Presents...
Date: 10/10/98
Advisory#: 01

There is a big security problem in America OnLine 4.x which allows
anybody to remotely crash AOL 4.x software by sending Email which AOL
software does not know how to handle and thus causes an invalid page
fault in module AOLRICH.AOL!

The exploit in essence is too send a email message to a America OnLine
user with a [ background ] image that has a 255 character name. This
could be created in America OnLine's own Email message composer or
perhaps in a Email program that allows HTML formatting. There might be
potential for remote execution of unauthorized code.

America OnLine 4.x software does a good job by warning the user before
opening the Email message that the evil message sent contains a picture
that could cause trouble for the reader.

NOTE: I have notifyed AOL about this problem so they should address
this issue very soon. hopefully!



Get Your Private, Free Email at

TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2015 AOH