Vulnerability Note VU#735966

AOL Instant Messenger vulnerable to buffer overflow

Overview

A vulnerability in the AOL Instant Messenger (AIM) client could allow a remote attacker to execute arbitrary code on a victim system.

I. Description

AOL Instant Messenger (AIM) is an instant messaging system distributed by AOL Time Warner. A buffer overflow error exists in the way that some versions of the AIM client software handle AIM 'Away' messages. This error creates a vulnerability that can be exploited by remote attackers supplying overly long input to the goaway function of the aim: URI handler. Exploitation of this vulnerability requires an AIM user to click on a malicious URL supplied in an instant message or embedded in a web page.

II. Impact

An intruder may be able to execute arbitrary code on a vulnerable system. The intruder-supplied code would run with the privileges of the user running an instance of the vulnerable AIM client.

III. Solution

The CERT/CC is currently unaware of a practical solution to this problem.

Workarounds

AOL has published a bulletin (refer to the section titled "AOL Instant Messenger URI Handler Buffer Overflow") recommending the following workaround for this issue:

aim:

HKEY_CLASSES_ROOT\aim

The following script can be saved to a file with the .vbs extension and executed to automate the task of removing the relevant URI handler:

Set WshShell = CreateObject("WScript.Shell")
WshShell.RegDelete "HKCR\aim\"

Note that this workaround is specific to users of the AIM client software for the Windows operating system. Users are strongly encouraged to apply this workaround until a patched version of the AIM client software is available.

Systems Affected

Vendor	Status	Date Notified	Date Updated
AOL Time Warner	Unknown	9-Aug-2004

References

http://secunia.com/advisories/12198/
http://www.idefense.com/application/poi/display?id=121&type=vulnerabilities
http://www.securitytracker.com/alerts/2004/Aug/1010901.html

Credit

The CERT/CC is aware of coincidental public disclosure of this issue by Secunia and iDefense. Secunia credits Ryan McGeehan and Kevin Benes for reporting this issue and iDefense credits Matt Murphy.

This document was written by Chad R Dougherty.

Other Information

Date Public:	2004-08-09
Date First Published:	2004-08-10
Date Last Updated:	2004-08-31
CERT Advisory:
CVE-ID(s):	CAN-2004-0636
NVD-ID(s):	CAN-2004-0636
US-CERT Technical Alerts:
Metric:	14.38
Document Revision:	20

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Get Adobe Reader