Intruders Could Take AIM at AOL

A security firm has notified AOL that a potentially critical security hole exists in its instant messaging software, commonly referred to as AIM, that would permit an intruder to gain complete control over a user's system.

Officials from Core Security Technologies said it contacted AOL about the flaw late last month. While company executives at AOL say the hole has been closed, Core Security officials counter that the fix doesn't go far enough. However, one Core Security official said it remains unclear whether anyone has successfully exploited the hole.

The flaw resides in the most recent beta releases of AIM 6.1 and 6.2. Core Security has also found the hole in the AIM Pro, intended mainly for business users, and in AIM Lite. The company said the problem doesn't exist in version 5.9 of AIM nor in AIM 6.5, a product also currently in beta testing.

The security hole arose, according to Core Security, because of the way the affected versions allow instant messaging users to augment their conversations with a number of fonts and pictographic "emoticons." The flawed versions of AIM do this by using Microsoft Corp.'s Internet Explorer program to render images, they explained.

Core Security contends that the real problem involves AIM enabling full access to all of Internet Explorer's functions, including the ability to carry out programming commands and direct them at Web sites. By embedding specific commands in an IM session, hackers can direct a user's system to do things such as visit malicious Web sites where even more bad code could be installed.

AOL officials responded by saying the issue has been resolved and that users should feel "completely safe."

Posted by Ed Scannell on 09/27/2007 at 1:23 PM


Featured

  • How To Run Oculus Rift Apps in Windows Mixed Reality, Part 1

    A lack of apps has been the biggest thorn in the side of Microsoft's mixed reality efforts. One way to get around it is to use apps that were designed for Oculus Rift instead.

  • Windows 10 Mobile To Fall Out of Support in December

    Microsoft will end support for the Windows 10 Mobile operating system on Dec. 10, 2019, according to an announcement.

  • Get More Out of Your Outlook Inbox with TakeNote

    Brien comes across a handy, but imperfect, feature in Outlook that lets you annotate specific e-mails. Its provenance is something of a mystery, though.

  • Microsoft Resumes Rerelease of Windows 10 Version 1809

    Microsoft on Wednesday once more resumed its general rollout of the Windows 10 version 1809 upgrade, also known as the "October 2018 Update."

comments powered by Disqus
Most   Popular

Office 365 Watch

Sign up for our newsletter.

Terms and Privacy Policy consent

I agree to this site's Privacy Policy.