AIM Security Hole Opens Users to Remote Attack

iDEFENSE Inc. reports in its advisory that oversized values passed to the "goaway" function of AIMs "aim:" URI handler may be used to overwrite the pointer to the Structured Exception Handler, which could then be used to execute code written by the attacker.

The attack would appear as a link in the instant messaging window, and the user would have to click on the link in order to be subject to the vulnerability.

Secunias advisory is less-detailed but addresses the same vulnerability. Secunia recommends that users switch to another instant messaging product.

In Version 5.5, AIM embraces video chat with the Mac. Click here to read more.

America Online Inc.s AIM 5.5 has been tested and shown to be vulnerable, but iDEFENSE suspects that previous versions are also vulnerable. The iDEFENSE advisory says that AOL "recommends that Windows users of AIM upgrade to the latest beta version to be released on Aug. 9.

"This new version of AIM addresses the vulnerability described herein and can be obtained via the AOL Instant Messenger portal."

The iDEFENSE advisory notes that AIM 5.5 was compiled with Microsoft Visual Studio .NET 2003 and incorporates that compilers stack protection, but iDEFENSE has confirmed that exploitation is still possible.

Check out eWEEK.coms Security Center at http://security.eweek.com for security news, views and analysis.

Be sure to add our eWEEK.com security news feed to your RSS newsreader or My Yahoo page:  

>>> More IT Security & Network Security News & Reviews Articles          >>> More By Larry Seltzer