Signature Detail

AIM: Oversized Message

This protocol anomaly indicates an AIM message in which one of the following exceeds a user-defined maximum: FLAP header, file transfer frame header, or an inter-client-message-block (ICMB). For FLAP header data: The command header is known as the FLAP. FLAP header default value: 10000. You can change this setting. In IDP Manager: Select a security policy from Security Policies, then select the Sensor Settings tab. Select Protocol Thresholds and Configuration > AIM. In Netscreen-Security Manager: In the device navigation tree select Security > IDP SM Settings, then select the Protocol Thresholds and Configuration tab. Under AIM, click the Show button. Set the Maximum header length to the new value and click OK. For file transfer frame header: The header specifies the filename that the message is transferring. Maximum filename length default value: 10000. In IDP Manager: Select a security policy from Security Policies, then select the Sensor Settings tab. Select Protocol Thresholds and Configuration > AIM. Double-click the value next to Maximum filename length, then change the value and press Enter. In Netscreen-Security Manager: In the device navigation tree select Security > IDP SM Settings, then select the Protocol Thresholds and Configuration tab. Under AIM, click the Show button. Set the Maximum filename length to the new value and click OK. For ICMB: When an instant message is transmitted, AIM/ICQ breaks it into multiple message blocks (ICMBs) and sends each block in a separate TLV. ICMB length default value: 2000. You can change this setting. In IDP Manager: Select a security policy from Security Policies, then select the Sensor Settings tab. Select Protocol Thresholds and Configuration > AIM. Double-click the value next to Maximum inter-client-message-block length, then change the value and press Enter. In Netscreen-Security Manager: In the device navigation tree select Security > IDP SM Settings, then select the Protocol Thresholds and Configuration tab. Under AIM, click the Show button. Set the Maximum inter-client-message-block length to the new value and click OK.

References

• URL: http://en.wikipedia.org/wiki/AOL_Instant_Messenger
• URL: http://iserverd1.khstu.ru/oscar/
• URL: http://www.kingant.net/oscar/