CVE-2002-1831

Description

Microsoft MSN Messenger Service 1.0 through 4.6 allows remote attackers to cause a denial of service (crash) via an invite request that contains hex-encoded spaces (%20) in the Invitation-Cookie field.

Affected products

• microsoft / msn_messenger1.0 – 1.0
• microsoft / msn_messenger2.0 – 2.0
• microsoft / msn_messenger2.2 – 2.2
• microsoft / msn_messenger3.0 – 3.0
• microsoft / msn_messenger3.6 – 3.6
• microsoft / msn_messenger4.0 – 4.0
• microsoft / msn_messenger4.5 – 4.5
• microsoft / msn_messenger4.6 – 4.6

Exploits & proofs of concept

• exploit-dbMicrosoft MSN Messenger 1 < 4 - Malformed Invite Request Denial of Serviceby Beck Mr.R

References

• MISChttp://www.iss.net/security_center/static/9161.php
• MISChttp://www.securityfocus.com/bid/4827
• MISChttp://online.securityfocus.com/archive/1/274086