Officials from Core Security Technologies said it contacted AOL about the
flaw late last month. While company executives at AOL say the hole has been
closed, Core Security officials counter that the fix doesn't go far enough.
However, one Core Security official said it remains unclear whether anyone has
successfully exploited the hole.
The flaw resides in the most recent beta releases of AIM 6.1 and 6.2. Core
Security has also found the hole in the AIM Pro, intended mainly for business
users, and in AIM Lite. The company said the problem doesn't exist in version
5.9 of AIM nor in AIM 6.5, a product also currently in beta testing.
The security hole arose, according to Core Security, because of the way the
affected versions allow instant messaging users to augment their conversations
with a number of fonts and pictographic "emoticons." The flawed versions
of AIM do this by using Microsoft Corp.'s Internet Explorer program to render
images, they explained.
Core Security contends that the real problem involves AIM enabling full access
to all of Internet Explorer's functions, including the ability to carry out
programming commands and direct them at Web sites. By embedding specific commands
in an IM session, hackers can direct a user's system to do things such as visit
malicious Web sites where even more bad code could be installed.
AOL officials responded by saying the issue has been resolved and that users
should feel "completely safe."
Posted by Ed Scannell on September 27, 2007 at 11:57 AM
Microsoft this week demonstrated how its natural language AI capabilities in Microsoft 365 Copilot will widely extend across the company's products and services.
Microsoft unveiled update 23H1 for the SharePoint Server Subscription Edition (SE) product and a handful of service and plan changes this week.
The team that managed the ethics surrounding Microsoft's artificial intelligence (AI) software development was laid off this month.
Here's your guide to all the IT training sessions, partner meet-ups and annual Microsoft conferences you won't want to miss.
More Partner Guides
More White Papers