Description
Hotfoon 4.0 does not notify users before opening links in web browsers, which could allow remote attackers to execute arbitrary code via a certain link sent in a chat window.
References
- 20041110 Hotfoon Ver 4.0 Highv Risk mailing-list
- 13173 third-party-advisory
- hotfoon-url-command-execution(18038) vdb-entry