| CVE ID | |
| CVSS SCORE | |
| AFFECTED VENDORS |
America Online |
| AFFECTED PRODUCTS |
AIM |
| TREND MICRO CUSTOMER PROTECTION | Trend Micro TippingPoint IPS customers are protected against this vulnerability by Digital Vaccine protection filter ID ['6024']. For further product information on the TippingPoint IPS: http://www.tippingpoint.com |
| VULNERABILITY DETAILS |
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of any communication application utilizing the SIP Foundry API. This includes vendors such as AOL, Yahoo, Skype, Oracle, Nortel and more. Authentication is not required to exploit these vulnerabilities, however a user must have a voice session active to expose the flaw. The specific flaw exists when parsing RTP information destined for the target client. When the value for the RTP header value "Extension Length" is improperly used a heap overflow occurs. Proper exploitation can lead to remote compromise of the system under the credentials of the logged in user. |
| ADDITIONAL DETAILS |
Fixed in AIM 6.8 client, version 6.8.7.7. |
| DISCLOSURE TIMELINE |
|
| CREDIT | wushi of team509 |
