Overview
AOL Instant Messenger (AIM) disclose local file paths during transfer.
Description
AOL Instant Messenger (AIM) is a program for communicating with other users over the Internet. AIM permits users to transfer files from one client to another. When the file is transferred, the entire local path of the file on the sender's machine is sent to the recipient. This could pose privacy and security risks. An attacker could use this information to extrapolate the location of other files on the victim's machine, and use this information in conjunction with another vulnerability. |
Impact
Unauthorized disclosure of information about the victim's machine is transmitted to the attacker. |
Solution
The latest version of AIM allows the user to configure whether the recipient can see the full path of a transferred file. Upgrade to the latest build and enable this feature. |
Vendor Information
CVSS Metrics
| Group | Score | Vector |
|---|---|---|
| Base | ||
| Temporal | ||
| Environmental |
References
Acknowledgements
Our thanks to Daniel P. Stasinski
This document was written by Jason Rafail
Other Information
| CVE IDs: | CVE-2000-0383 |
| Severity Metric: | 0.69 |
| Date Public: | 2000-05-08 |
| Date First Published: | 2002-01-31 |
| Date Last Updated: | 2002-01-31 21:37 UTC |
| Document Revision: | 8 |