AOL Instant Messenger URL href Attribute Traversal Arbitrary Local File Execution
Medium Nessus Network Monitor Plugin ID 1245
SynopsisAn attacker can execute local files on the remote AOL Client
DescriptionThe remote host is running AOL Instant Messenger (AIM). AIM is prone to an issue that may allow attackers to execute arbitrary files on the client system. It is possible to send a malicious link that references local files to a user of the client. When the link is visited, the referenced file on the client's local filesystem will be executed. To exploit this issue, the attacker must know the exact location of the file to be executed. Additionally, there can be no spaces in the path or filename. This limits exploitability, since files must be on the same partition and command line arguments cannot be supplied. Versions other than AOL Instant Messenger 4.8.2790 do not seem to be affected by this vulnerability.
SolutionThis issue reportedly only present in AOL Instant Messenger 4.8.2790. Users may address this issue by upgrading or downgrading to another version.