Author Topic: This is why aim sucks  (Read 4575 times)

0 Members and 1 Guest are viewing this topic.

Offline deadly7

  • 42
  • x86
  • Hero Member
  • *****
  • Posts: 6496
    • View Profile
This is why aim sucks
« on: February 03, 2006, 05:10:04 pm »
Quote
As I submitted to full disclosure:

"I have discovered that there is a buffer overrun vulnerability in AOL's Instant Messenger program. I have only tested this on version 5.9.3861. The problem causes a minimum of a program crash. I am not sure as to the posibility of shellcode execution.

The vulnerability can be exploited by supplying an overly large username from which to obtain "buddy info."

If you are unsure as to what I am talking about, I can post a screenshot."

Well, I made a Macromedia Captivate-made video of it. http://www.dotshell.net/aim.swf. What I am thinking is that a program can be
I found that hilarious.
[17:42:21.609] <Ergot> Kutsuju you're girlfrieds pussy must be a 403 error for you
 [17:42:25.585] <Ergot> FORBIDDEN

on IRC playing T&T++
<iago> He is unarmed
<Hitmen> he has no arms?!

on AIM with a drunk mythix:
(00:50:05) Mythix: Deadly
(00:50:11) Mythix: I'm going to fuck that red dot out of your head.
(00:50:15) Mythix: with my nine

Offline Ergot

  • 吴立峰 ^_^ !
  • x86
  • Hero Member
  • *****
  • Posts: 3724
  • I steal bandwidth. p_o
    • View Profile
Re: This is why aim sucks
« Reply #1 on: February 03, 2006, 07:01:30 pm »
I don't know why it's in media center... but will it work that that aim command thingy, if there is one to get profile.
No there isn't... so kinda useless ;P ?
« Last Edit: February 03, 2006, 07:04:17 pm by Ergot »
Who gives a damn? I fuck sheep all the time.
And yes, male both ends.  There are a couple lesbians that need a two-ended dildo...My router just refuses to wear a strap-on.
(05:55:03) JoE ThE oDD: omfg good job i got a boner thinkin bout them chinese bitches
(17:54:15) Sidoh: I love cosmetology

Offline Newby

  • x86
  • Hero Member
  • *****
  • Posts: 10877
  • Thrash!
    • View Profile
Re: This is why aim sucks
« Reply #2 on: February 03, 2006, 08:14:24 pm »
Uhh.... so?
- Newby
http://www.x86labs.org

Quote
[17:32:45] * xar sets mode: -oooooooooo algorithm ban chris cipher newby stdio TehUser tnarongi|away vursed warz
[17:32:54] * xar sets mode: +o newby
[17:32:58] <xar> new rule
[17:33:02] <xar> me and newby rule all

I'd bet that you're currently bloated like a water ballon on a hot summer's day.

That analogy doesn't even make sense.  Why would a water balloon be especially bloated on a hot summer's day? For your sake, I hope there wasn't too much logic testing on your LSAT. 

Offline Joe

  • B&
  • x86
  • Hero Member
  • *****
  • Posts: 10319
  • In Soviet Russia, text read you!
    • View Profile
    • Github
Re: This is why aim sucks
« Reply #3 on: February 04, 2006, 02:07:07 am »
Hah, people actually use buddy lookup?
I'd personally do as Joe suggests

You might be right about that, Joe.


Offline deadly7

  • 42
  • x86
  • Hero Member
  • *****
  • Posts: 6496
    • View Profile
Re: This is why aim sucks
« Reply #4 on: February 04, 2006, 02:10:49 am »
I don't know why it's in media center... but will it work that that aim command thingy, if there is one to get profile.
No there isn't... so kinda useless ;P ?
I was..
"high! +1"

someone wanna move this to general security info, which i missed terribly?
[17:42:21.609] <Ergot> Kutsuju you're girlfrieds pussy must be a 403 error for you
 [17:42:25.585] <Ergot> FORBIDDEN

on IRC playing T&T++
<iago> He is unarmed
<Hitmen> he has no arms?!

on AIM with a drunk mythix:
(00:50:05) Mythix: Deadly
(00:50:11) Mythix: I'm going to fuck that red dot out of your head.
(00:50:15) Mythix: with my nine

Offline Krazed

  • x86
  • Hero Member
  • *****
  • Posts: 1822
    • View Profile
Re: This is why aim sucks
« Reply #5 on: February 04, 2006, 10:28:42 am »
This is a retarded reason to say AIM sucks. Who is going to sit there and type fake screennames of that length into a buddy lookup anyway? Theres no way to remotely expoit this. Garbage.  :)
It is good to be good, but it is better to be lucky.

Offline deadly7

  • 42
  • x86
  • Hero Member
  • *****
  • Posts: 6496
    • View Profile
Re: This is why aim sucks
« Reply #6 on: February 04, 2006, 03:26:21 pm »
This is a retarded reason to say AIM sucks. Who is going to sit there and type fake screennames of that length into a buddy lookup anyway? Theres no way to remotely expoit this. Garbage.  :)
It could be a real screen name, too.  It just has to break AIM. :P!  I feel like trying it.
[17:42:21.609] <Ergot> Kutsuju you're girlfrieds pussy must be a 403 error for you
 [17:42:25.585] <Ergot> FORBIDDEN

on IRC playing T&T++
<iago> He is unarmed
<Hitmen> he has no arms?!

on AIM with a drunk mythix:
(00:50:05) Mythix: Deadly
(00:50:11) Mythix: I'm going to fuck that red dot out of your head.
(00:50:15) Mythix: with my nine

Offline Quik

  • Webmaster Guy
  • x86
  • Hero Member
  • *****
  • Posts: 3262
  • \x51 \x75 \x69 \x6B \x5B \x78 \x38 \x36 \x5D
    • View Profile
Re: This is why aim sucks
« Reply #7 on: February 04, 2006, 04:22:10 pm »
This is a retarded reason to say AIM sucks. Who is going to sit there and type fake screennames of that length into a buddy lookup anyway? Theres no way to remotely expoit this. Garbage.  :)
It could be a real screen name, too.  It just has to break AIM. :P!  I feel like trying it.

No it couldn't, they are limited to 16 characters. There is no way to remotely exploit this, I'm not even sure how one could execute code unless they were sitting there. If you have local access, what's the point?
Quote
[20:21:13] xar: i was just thinking about the time iago came over here and we made this huge bomb and light up the sky for 6 min
[20:21:15] xar: that was funny

Offline Warrior

  • supreme mac daddy of trolls
  • Hero Member
  • *****
  • Posts: 7503
  • One for a Dime two for a Quarter!
    • View Profile
Re: This is why aim sucks
« Reply #8 on: February 04, 2006, 08:46:26 pm »
Oh yea aim really sucks because of this..or use a different client yea.
Like stated there is no way to exploit this and until one is found this wont be anything other than a bug in code
you know, those things every program have
One must ask oneself: "do I will trolling to become a universal law?" And then when one realizes "yes, I do will it to be such," one feels completely justified.
-- from Groundwork for the Metaphysics of Trolling

Offline deadly7

  • 42
  • x86
  • Hero Member
  • *****
  • Posts: 6496
    • View Profile
Re: This is why aim sucks
« Reply #9 on: February 04, 2006, 08:52:42 pm »
This is a retarded reason to say AIM sucks. Who is going to sit there and type fake screennames of that length into a buddy lookup anyway? Theres no way to remotely expoit this. Garbage.  :)
It could be a real screen name, too.  It just has to break AIM. :P!  I feel like trying it.

No it couldn't, they are limited to 16 characters. There is no way to remotely exploit this, I'm not even sure how one could execute code unless they were sitting there. If you have local access, what's the point?
I've had screen names longer than 16 characters before -- they must've imposed the limit within the last 4 years.
[17:42:21.609] <Ergot> Kutsuju you're girlfrieds pussy must be a 403 error for you
 [17:42:25.585] <Ergot> FORBIDDEN

on IRC playing T&T++
<iago> He is unarmed
<Hitmen> he has no arms?!

on AIM with a drunk mythix:
(00:50:05) Mythix: Deadly
(00:50:11) Mythix: I'm going to fuck that red dot out of your head.
(00:50:15) Mythix: with my nine

Offline Krazed

  • x86
  • Hero Member
  • *****
  • Posts: 1822
    • View Profile
Re: This is why aim sucks
« Reply #10 on: February 05, 2006, 05:30:03 pm »
There is no screennames past 16 chars. End of discussion. This "exploit" is garbage.  :)
It is good to be good, but it is better to be lucky.