| Msn Messenger Protocol has a vulnerability that = allows=20 kicking of all users in a group=20 conversation. |
| Dcrab 's Security =
Advisory [Hsc Security=20 Group] http://www.hackerscenter.com/ [dP Security]=20 http://digitalparadox.org/ Get Dcrab's Services to audit = your Web=20 servers, scripts, networks, etc. Learn more at=20 http://www.dbtech.org Severity: High Title: Msn = Messenger=20 Protocol has a vulnerability that allows kicking of all users in a = group=20 conversation. Date: 10/07/2005 Details: While in = a group=20 conversation, sending a plain text message containing ".pif" = causes not=20 just you, but all the users in the conversation to be kicked. = It also=20 makes it impossible to figure out which one of the users has = caused the=20 "booting" to take place. You can read a article about = this at,=20 http://www.messenger-blog.com/ Also, a special thank you to = TB=20 regarding this issue, as he has taken on the job of further = investigating=20 it. UPDATE: It also seems to work on gaim, and therefore is = probably a msn server, or protocol issue. Keep your self = updated,=20 Rss feed at: http://digitalparadox.org/rss.ah Author: = These=20 vulnerabilties have been found and released by Diabolic Crab, = Email:=20 dcrab[AT|NOSPAM]hackerscenter[DOT|NOSPAM]com, please feel free = to=20 contact me regarding these vulnerabilities. You can find me at,=20 http://www.hackerscenter.com or http://digitalparadox.org/. = Lookout=20 for my soon to come out book on Secure coding with=20 php. |