A vulnerability in the AOL Instant Messenger (AIM) client could allow a remote attacker to execute arbitrary code on a victim system.
AOL Instant Messenger (AIM) is an instant messaging system distributed by AOL Time Warner. A buffer overflow error exists in the way that some versions of the AIM client software handle AIM 'Away' messages. This error creates a vulnerability that can be exploited by remote attackers supplying overly long input to the goaway function of the aim: URI handler. Exploitation of this vulnerability requires an AIM user to click on a malicious URL supplied in an instant message or embedded in a web page.
An intruder may be able to execute arbitrary code on a vulnerable system. The intruder-supplied code would run with the privileges of the user running an instance of the vulnerable AIM client.
The CERT/CC is currently unaware of a practical solution to this problem.
AOL has published a bulletin (refer to the section titled "AOL Instant Messenger URI Handler Buffer Overflow") recommending the following workaround for this issue:
The following script can be saved to a file with the .vbs extension and executed to automate the task of removing the relevant URI handler:
Set WshShell = CreateObject("WScript.Shell")
Note that this workaround is specific to users of the AIM client software for the Windows operating system. Users are strongly encouraged to apply this workaround until a patched version of the AIM client software is available.
The CERT/CC is aware of coincidental public disclosure of this issue by Secunia and iDefense. Secunia credits Ryan McGeehan and Kevin Benes for reporting this issue and iDefense credits Matt Murphy.
This document was written by Chad R Dougherty.
|Date First Published:||2004-08-10|
|Date Last Updated:||2004-08-31 21:08 UTC|