AIM Security Hole Opens Users to Remote Attack
Researchers discover a remote buffer overflow that could allow an attacker to run arbitrary code on another user's Windows-based system; AOL is expected to issue a patch.Two security research and consulting companies have reported a vulnerability in the AIM (AOL Instant Messenger) program that could allow an attacker to run arbitrary code on another users Windows-based system. iDEFENSE Inc. reports in its advisory that oversized values passed to the "goaway" function of AIMs "aim:" URI handler may be used to overwrite the pointer to the Structured Exception Handler, which could then be used to execute code written by the attacker. The attack would appear as a link in the instant messaging window, and the user would have to click on the link in order to be subject to the vulnerability.
Secunias advisory is less-detailed but addresses the same vulnerability. Secunia recommends that users switch to another instant messaging product.