A privacy flaw in MSN Messenger that exposes IM nicknames and could reveal users' e-mail addresses:
Among the fun and games one can have with a vulnerable Messenger user are such sports as impersonating the victim and sending spoof messages and spoof e-mail memos to his contacts, and scouring his local drive for interesting files to share around.
In other words, you can do anything with the victim's Messenger client that the owner can do.
A demonstration has been set up here.
The problem is not a bug in Messenger, but one in IE, namely the Document.Open() vulnerability discovered in mid-December by ThePull, which allows for cookies to be gathered and documents to be read. This one is demonstrated here.
There is not yet a patch for this and several other IE holes. Vulnerable systems include:
- Windows 98 SE with IE6 final (fully patched as of Feb 9) and MSN Messenger 4.6.0073
- Windows 98 SE with IE6 final and MSN Messenger 3.6.0024
- Windows ME with IE6 final (fully patched as of Feb 9) and MSN Messenger 4.5.0127
- Windows 2000 with IE6 final (fully patched as of Feb 9) and MSN Messenger 4.6.0071
- Windows 2000, IE5.5, MSN Messenger 4.6.00.73
Interestingly, MS released a major IE patch late last week but quickly removed it. Whether this was because they'd neglected to address this exploit or because the patch was ineffective or because it breaks people's computers we don't know.
ZDNet reports that while representatives for the Microsoft Network have said no customers have fallen prey to the potential privacy problem, the group plans to release early next week an updated version of MSN Messenger that fixes the problem.
Source: The Register
