eWEEK content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.
Two security research and consulting companies have reported a vulnerability in the AIM (AOL Instant Messenger) program that could allow an attacker to run arbitrary code on another users Windows-based system.
iDEFENSE Inc. reports in its advisory that oversized values passed to the “goaway” function of AIMs “aim:” URI handler may be used to overwrite the pointer to the Structured Exception Handler, which could then be used to execute code written by the attacker.
The attack would appear as a link in the instant messaging window, and the user would have to click on the link in order to be subject to the vulnerability.
Secunias advisory is less-detailed but addresses the same vulnerability. Secunia recommends that users switch to another instant messaging product.
America Online Inc.s AIM 5.5 has been tested and shown to be vulnerable, but iDEFENSE suspects that previous versions are also vulnerable. The iDEFENSE advisory says that AOL “recommends that Windows users of AIM upgrade to the latest beta version to be released on Aug. 9.
“This new version of AIM addresses the vulnerability described herein and can be obtained via the AOL Instant Messenger portal.“
The iDEFENSE advisory notes that AIM 5.5 was compiled with Microsoft Visual Studio .NET 2003 and incorporates that compilers stack protection, but iDEFENSE has confirmed that exploitation is still possible.
Be sure to add our eWEEK.com security news feed to your RSS newsreader or My Yahoo page: