Home    |    View Topics    |    Search    |    Contact Us    |   



Category:   Application (Instant Messaging/IRC/Chat)  >   AOL Instant Messenger Vendors:   America Online, Inc.
AOL Instant Messenger (AIM) May Disclose AIM Passwords to Remote Users in Certain Situations
SecurityTracker Alert ID:  1003663
SecurityTracker URL:
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  Feb 26 2002
Impact:   Disclosure of authentication information
Exploit Included:  Yes  

Description:   A password disclosure vulnerability was reported in AOL Instant Messenger (AIM). In certain situations, a remote user can obtain the AIM password of another AIM user.

A remote user can reportedly retrieve the password of AOL Instant Messenger screen names if the AIM screen name is registered to the same [screenname] address but the AOL account is no longer valid and not in AOL's system. It is reported that a [screenname] address might no longer be in AOL's system after 6 months past the date that the AOL account was cancelled or terminated.

The steps necessary to trigger the flaw are provided in the Source Message.

The vulnerability appears to be due to a logic flaw in AOL's systems (as opposed to an issue with the AIM client software).

The vendor has reportedly been notified.

Impact:   A remote user can obtain the AIM password of another AIM user in certain situations.
Solution:   No solution was available at the time of this entry.

The author of the report recommends that AIM users make sure their AIM screen name's email address isn't registered to its old [screenname] address.

Vendor URL: (Links to External Site)
Cause:   State error
Underlying OS:  Windows (Any)

Message History:   None.

 Source Message Contents

Subject:  AOL/AOL Instant Messenger Vulnerability

AOL/AOL Instant Messenger Vulnerability


Author: Robert Lyttle (
Contributors: r0cky
Release Date: 02.24.02 - 2:00 AM

Disclaimer: and/or Robert Lyttle is not responsible for the misuse of the following information. 

The below was executed against business associates with their express permission as proof of concept. 

This is the second significant public release of a hole within AOL's software, making it the 4th significant hole discovered in AOL
 software since Jan 1, 2002. (w00w00, this one, and two other private vulnerabilities) In 1999, 2000, and 2001 there were related
 vulnerabilities against AOL Instant Messenger. 

It is possible to retrieve the password of AOL Instant Messenger screen names through the,
 and websites. This then leading to possible gain of other accounts such as FTP, e-mail, and so on.

Susceptible to retrieving current password:
AOL Instant Messenger screen names that are registered to the same address, but those that no longer exist in AOL's system
 (Usually 6 months after cancellation/termination of account.) Example: We have an AOL Instant Messenger screen name "hi mom" that
 is registered under the e-mail hi - and since the hi account is no longer in AOL's system, it is vulnerable.

Susceptible to take-over, but without current password:
AOL Instant Messenger screen names that are not currently in AOL's system. Social Engineering required. 


-At the first page enter in any information you desire. (Remember this information if you plan on social engineering your way in later.)
 Now press continue.

-On the next page you will be asked for a screen name and password. Enter in an AOL Instant Messenger screen name and password that
 you own, that is NOT in AOL's system - Check the check box that says "Check here to use your AIM name on AOL" Now press continue.

-On the next page you will be asked for billing information and a new browser window will pop up. Click the "I Agree" button in the
 new browser window, it should close. Go back to the initial browser window and press the "Cancel" link on the bottom left hand corner.

-On the next page you will be brought to a new screen that talks about Joining AOL without a credit card. Now press continue.

The next 2 pages will be for verification -- Keep pressing "Continue" on the next 2 pages until you get to the page that asks for
 another screen name and password.

If you've done this correctly you will be greeted with "Sorry, <thename> is taken" then asked to enter another screen name and password
 as stated before. This is where you enter the screen name that you would like to retrieve the password from. (If you enter a screen
 name that is on AOL already, you will get error saying that it is already taken.) Other errors might occur when trying certain screen
 names, simply press the back button and try again.

So, say we enter "S7S Robert" and for the password field you would enter any password (DONT FORGET IT, this will be used in the following
 steps) Press the continue button and if the name was vulnerable you will be taken to a new page and greeted with "Welcome to America
 Online! Congratulations S7S Robert!" Now we have access to login to the AOLAnywhere service with the account that
 was just created. 

-Now to retrieve the current password of S7S Robert, we visit and use the Lost Password feature found under Help.
 Enter in the screen name of the password to be retrieved and press Submit.

-Visit to use AOLAnywhere and login to the account using the password you chose before. You should have an e-mail
 in there from AOL with the password to the screen name. 

If you didn't receive an e-mail from the Lost Password feature, this means that the AOL Instant Messenger screen name was not registered
 under the address. 

>From here an attacker could change the password to the AOL Instant Messenger screen name and also try the same password against the
 victims other accounts.(FTP, SSH, etc)

To test this simply register an AOL Instant Messenger name at and when it asks for the e-mail address to use, make
 it the same as the screen name and append For instance, if I want to test with "S7S Robert" I would enter the email address
 S7S as well. Once you've done that, you can use the above directions and see that you do not need the password used
 in the screen name registration process to retrieve it.

I've e-mailed AOL multiple times before this advisory and have yet to receive a reply, so hopefully they are working on it. In the
 mean time, just make sure your AOL Instant Messenger screen name's email address isn't registered to its old address.

- Robert Lyttle

Delivery co-sponsored by VeriSign - The Internet Trust Company
Do you have 128-bit SSL encryption server security?
Get VeriSign's FREE Guide, "Securing Your Web Site for Business," and learn
everything you need to know about using 128-bit SSL to encrypt your
e-commerce transactions, secure your intranets and authenticate your Web
site. 128-bit SSL is serious security for your online business. Get it now!


Go to the Top of This SecurityTracker Archive Page

Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2021, LLC