NVD

Id
56991  
Name
CVE-2007-4901  
Description
The embedded Internet Explorer server control in AOL Instant Messenger (AIM) 6.1.41.2 and 6.2.32.1, AIM Pro, and AIM Lite does not properly constrain the use of mshtml.dll"s web script and HTML functionality for incoming instant messages, which allows remote attackers to place HTML into unexpected contexts or execute arbitrary code, as demonstrated by writing arbitrary HTML to a notification window, and writing contents of arbitrary local image files to this window via IMG SRC.  
Reject
 
CVSS Version
2  
CVSS Score
5.8  
Severity
Medium  
CVSS Base Score
5.8  
CVSS Impact Subscore
4.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:P/I:P/A:N)  
Pub Date
2017-01-07  
Published
2007-09-14  
Modified Date
2008-09-05  
Seq
2007-4901  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
290909 56991 CVE-2007-4901 http://aviv.raffon.net/2007/09/25/ReadyAIMFire.aspx  View
290910 56991 CVE-2007-4901 3136  View
290911 56991 CVE-2007-4901 http://www.coresecurity.com/index.php5?module=ContentMod&action=item&id=1924  View
290912 56991 CVE-2007-4901 20070912 AIM Arbitrary HTML Display in Notification Window  View
290913 56991 CVE-2007-4901 20070914 AIM Local File Display in Notification Window  View
290914 56991 CVE-2007-4901 20070925 CORE-2007-0817: Remote Command execution, HTML and JavaScript injection vulnerabilities in AOL"s Instant Messaging software  View
290915 56991 CVE-2007-4901 20070925 RE: CORE-2007-0817: Remote Command execution, HTML and JavaScript injection vulnerabilities in AOL"s Instant Messaging software  View
290916 56991 CVE-2007-4901 25659  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
53939 JVNDB-2007-002631 Internet Explorer サーバコントロールにおける任意のコードを実行される脆弱性 AOL Instant Messenger (AIM)、AIM Pro、および AIM Lite の組み込まれた Internet Explorer サーバコントロールには、着信インスタントメッセージのために mshtml.dll の Web スクリプトおよび HTML 機能の使用を適切に制限しないため、予期しないコンテキストへ HTML を配置される、および任意のコードを実行される脆弱性が存在します。 CVE-2007-4901 28256 CVE-2007-4901 56991 5.8 http://jvndb.jvn.jp/ja/contents/2007/JVNDB-2007-002631.html 2007-09-14 2012-06-26 View