Facebook Google Plus Twitter LinkedIn YouTube RSS Menu Search Resource - BlogResource - WebinarResource - ReportResource - Eventicons_066 icons_067icons_068icons_069icons_070

AOL Instant Messenger URL href Attribute Traversal Arbitrary Local File Execution

Medium

Synopsis

An attacker can execute local files on the remote AOL Client

Description

The remote host is running AOL Instant Messenger (AIM). AIM is prone to an issue that may allow attackers to execute arbitrary files on the client system. It is possible to send a malicious link that references local files to a user of the client. When the link is visited, the referenced file on the client's local filesystem will be executed. To exploit this issue, the attacker must know the exact location of the file to be executed. Additionally, there can be no spaces in the path or filename. This limits exploitability, since files must be on the same partition and command line arguments cannot be supplied. Versions other than AOL Instant Messenger 4.8.2790 do not seem to be affected by this vulnerability.

Solution

This issue reportedly only present in AOL Instant Messenger 4.8.2790. Users may address this issue by upgrading or downgrading to another version.