Users login

Create an account »

JOIN XATRIX

Users login

Home » Hacking News » IE bug allows full MSN Messenger hijack

IE bug allows full MSN Messenger hijack

by Nikola Strahija on February 11th, 2002 The recent privacy stuff-up in Messenger "pales in comparison to what can be done if you use MSN Messenger through unpatched IE vulnerabilities," security researchers Tom Gilder and Thor Larholm have discovered.


Among the fun and games one can have with a vulnerable Messenger user are such sports as impersonating the victim and sending spoof messages and spoof e-mail memos to his contacts, and scouring his local drive for interesting files to share around.

Demonstration is here: http://tom.me.uk/msn/demo.html

The problem is in IE, namely the Document.Open() vulnerability discovered in mid-December by ThePull, which allows for cookies to be gathered and documents to be read.

There is not yet a patch for this and several other IE holes. Vulnerable systems include:

Windows 98 SE with IE6 final (fully patched as of Feb 9) and MSN Messenger 4.6.0073
Windows 98 SE with IE6 final and MSN Messenger 3.6.0024
Windows ME with IE6 final (fully patched as of Feb 9) and MSN Messenger 4.5.0127
Windows 2000 with IE6 final (fully patched as of Feb 9) and MSN Messenger 4.6.0071
Windows 2000, IE5.5, MSN Messenger 4.6.00.73

Using these, a malicious programmer can easily hijack the MSN
Messenger client from a user, allowing him/her (among others) to
silently and automatically read their contact list (harvesting email
addresses) and impersonate the user by sending arbitrary messages,
email or local files to anyone.


Newsletter signup

Signup to our monthly newsletter and stay in touch with IT news!

Free E-books

We've got ebooks! But they're not online. :( Please give us a few days to bring downloads back.

Contact

Have something to say or just wanna drop us a line? Please keep this in mind: to spam, we reply with spam.

Contact us »