Software Engineering Institute

AOL Instant Messenger (AIM) is an instant messaging system distributed by AOL Time Warner. A buffer overflow error exists in the way that some versions of the AIM client software handle AIM 'Away' messages. This error creates a vulnerability that can be exploited by remote attackers supplying overly long input to the goaway function of the aim: URI handler. Exploitation of this vulnerability requires an AIM user to click on a malicious URL supplied in an instant message or embedded in a web page.

An intruder may be able to execute arbitrary code on a vulnerable system. The intruder-supplied code would run with the privileges of the user running an instance of the vulnerable AIM client.

The CERT/CC is currently unaware of a practical solution to this problem.

Workarounds

AOL has published a bulletin (refer to the section titled "AOL Instant Messenger URI Handler Buffer Overflow") recommending the following workaround for this issue:

Exploitation of aim: URI handler vulnerabilities can be prevented by removing the following key from the registry:

HKEY_CLASSES_ROOT\aim

The following script can be saved to a file with the .vbs extension and executed to automate the task of removing the relevant URI handler:

Set WshShell = CreateObject("WScript.Shell")
WshShell.RegDelete "HKCR\aim\"

Note that this workaround is specific to users of the AIM client software for the Windows operating system. Users are strongly encouraged to apply this workaround until a patched version of the AIM client software is available.