AIM Security Hole Opens Users to Remote Attack

Two security research and consulting companies have reported a vulnerability in the AIM (AOL Instant Messenger) program that could allow an attacker to run arbitrary code on another users Windows-based system.

iDEFENSE Inc. reports in its advisory that oversized values passed to the “goaway” function of AIMs “aim:” URI handler may be used to overwrite the pointer to the Structured Exception Handler, which could then be used to execute code written by the attacker.

The attack would appear as a link in the instant messaging window, and the user would have to click on the link in order to be subject to the vulnerability.

Secunias advisory is less-detailed but addresses the same vulnerability. Secunia recommends that users switch to another instant messaging product.

/zimages/5/28571.gifIn Version 5.5, AIM embraces video chat with the Mac.Click hereto read more.

America Online Inc.s AIM 5.5 has been tested and shown to be vulnerable, but iDEFENSE suspects that previous versions are also vulnerable. The iDEFENSE advisory says that AOL “recommends that Windows users of AIM upgrade to the latest beta version to be released on Aug. 9.

“This new version of AIM addresses the vulnerability described herein and can be obtained via the AOL Instant Messenger portal.“

The iDEFENSE advisory notes that AIM 5.5 was compiled with Microsoft Visual Studio .NET 2003 and incorporates that compilers stack protection, but iDEFENSE has confirmed that exploitation is still possible.

/zimages/5/28571.gifCheck outeWEEK.coms Security Centerat http://security.eweek.com for security news, views and analysis.

/zimages/5/77042.gif

Be sure to add our eWEEK.com security news feed to your RSS newsreader or My Yahoo page:/zimages/5/19420.gifhttp://us.i1.yimg.com/us.yimg.com/i/us/my/addtomyyahoo2.gif