Intruders Could Take AIM at AOL

A security firm has notified AOL that a potentially critical security hole exists in its instant messaging software, commonly referred to as AIM, that would permit an intruder to gain complete control over a user's system.

Officials from Core Security Technologies said it contacted AOL about the flaw late last month. While company executives at AOL say the hole has been closed, Core Security officials counter that the fix doesn't go far enough. However, one Core Security official said it remains unclear whether anyone has successfully exploited the hole.

The flaw resides in the most recent beta releases of AIM 6.1 and 6.2. Core Security has also found the hole in the AIM Pro, intended mainly for business users, and in AIM Lite. The company said the problem doesn't exist in version 5.9 of AIM nor in AIM 6.5, a product also currently in beta testing.

The security hole arose, according to Core Security, because of the way the affected versions allow instant messaging users to augment their conversations with a number of fonts and pictographic "emoticons." The flawed versions of AIM do this by using Microsoft Corp.'s Internet Explorer program to render images, they explained.

Core Security contends that the real problem involves AIM enabling full access to all of Internet Explorer's functions, including the ability to carry out programming commands and direct them at Web sites. By embedding specific commands in an IM session, hackers can direct a user's system to do things such as visit malicious Web sites where even more bad code could be installed.

AOL officials responded by saying the issue has been resolved and that users should feel "completely safe."

Posted by Ed Scannell on September 27, 2007 at 11:57 AM


Featured

  • Microsoft Announces Milestones for 'Perpetual' Office Products

    Office 2021 for Windows, commonly thought of as the retail "boxed" product, will reach general availability on Oct. 5, the same day as Windows 11.

  • The Case for Windows 11 Will Be Made with Security and Telemetry

    Steering a Windows 11 move will be rough without measuring the gains or losses along the way, so says Cambridge, Mass.-based Microsoft partner Aternity.

  • The 2021 Microsoft Product Roadmap

    From Windows 10X to the next generation of Microsoft's application server products, here are the product milestones coming down the pipeline in 2021.

  • New Microsoft 365 Monitoring Platform Helps MSPs Avoid the 'Logo Blame Game'

    Martello Technologies has announced a new platform to help partners manage their customers' Microsoft 365 and Microsoft Teams deployments.