[NT] MSN Messenger Hijacking

From: support@securiteam.com
Date: 02/18/02 

From: support@securiteam.com
To: list@securiteam.com
Date: Mon, 18 Feb 2002 19:14:20 +0100 (CET)

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

When was the last time you checked your server's security?
How about a monthly report?
http://www.AutomatedScanning.com - Know that you're safe.
- - - - - - - - -

  MSN Messenger Hijacking
------------------------------------------------------------------------

SUMMARY

By exploiting Internet Explorer vulnerabilities, a malicious programmer
can easily hijack the MSN Messenger client from a user, allowing him/her
(among others) to silently and automatically read their contact list
(harvesting email addresses) and impersonate the user by sending arbitrary
messages, email or local files to anyone.

The victim would be unaware of any such action, and the malicious
programmer would in practice be impersonating himself as the victim
towards the MSN Messenger client, allowing him/her to do anything with MSN
Messenger that the victim would normally be able to.

DETAILS

Vulnerable systems:
 * Windows 98 SE with IE6 final (fully patched as of Feb 9) and MSN
Messenger 4.6.0073
 * Windows 98 SE with IE6 final and MSN Messenger 3.6.0024
 * Windows ME with IE6 final (fully patched as of Feb 9) and MSN Messenger
4.5.0127
 * Windows 2000 with IE6 final (fully patched as of Feb 9) and MSN
Messenger 4.6.0071
 * Windows 2000, IE5.5, MSN Messenger 4.6.00.73

Demonstration:
For an example on how this can be exploited, visit the hijacking
demonstration page at:
 <http://tom.me.uk/msn/demo.html.> http://tom.me.uk/msn/demo.html.

ADDITIONAL INFORMATION

The information has been provided by <mailto:tom@tom.me.uk> Tom Gilder.

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.