AIM Security Hole Opens Users to Remote Attack

AIM Security Hole Opens Users to Remote Attack:
"…oversized values passed to the 'goaway' function of AIM's 'aim:' URI handler may be used to overwrite the pointer to the Structured Exception Handler, which could then be used to execute code written by the attacker."

The attack would appear as a link in the instant messaging window, and the user would have to click on the link in order to be subject to the vulnerability.

America Online Inc.'s AIM 5.5 has been tested and shown to be vulnerable, but iDEFENSE suspects that previous versions are also vulnerable. The iDEFENSE advisory says that AOL "recommends that Windows users of AIM upgrade to the latest beta version to be released on Aug. 9.

"This new version of AIM addresses the vulnerability described herein and can be obtained via the AOL Instant Messenger portal.…"

http://www.eweek.com/article2/0,1759,1633779,00.asp?kc=ewnws081004dtx1k0000599