News Stay informed about the latest enterprise technology news and product updates.

Security flaws found in AOL, Yahoo IM programs

Attackers could exploit security flaws in popular instant messaging programs from AOL and Yahoo to upload malicious files on targeted computers.

Attackers could exploit vulnerabilities in popular instant messaging programs from AOL and Yahoo to upload malicious files on targeted computers, several security firms warned Wednesday.

Danish vulnerability clearinghouse Secunia warned in its SA26786 advisory that attackers could exploit a flaw in AOL Instant Messenger to execute arbitrary script code.

"Input passed to the notification window is not properly sanitized before being displayed to the user," Secunia said. "This can be exploited to execute a limited amount of arbitrary script code in the Local Zone (My Computer) context by sending a specially crafted message to another user."

Secure IM:
Quiz: Secure instant messaging: A five-question multiple choice quiz to test your understanding of the content presented in the Secure instant messaging lesson of's Messaging Security School.

Secure instant messaging in the enterprise: Instant messaging can be a conduit through which viruses come in to and sensitive data goes out of the corporate network.

Face-off: Instant messaging in the enterprise: Is instant messaging at work a matter of pure convenience, or pure danger?

Successful exploitation requires that the target user is chatting with a different user so that the notification window is shown, and that the attacker is in the buddy list of the target user or the target user accepts the IM message from the attacker, Secunia noted. The flaw affects version of the program, and other versions may be affected as well.

Until AOL fixes the problem, Secunia recommends users protect themselves by disabling the "New IMs arrive" option in the notifications settings and adding only trusted users to the buddy list.

Meanwhile, Cupertino, Calif.-based antivirus giant Symantec Corp. warned customers of its DeepSight threat management service that Yahoo Messenger is prone to an arbitrary file-upload vulnerability.

An ActiveX control in the program fails to adequately sanitize user-supplied input, allowing attackers to upload malicious files to an arbitrary location on a victim's computer, with the permissions of the application using the ActiveX control (typically Internet Explorer), Symantec said. Yahoo Messenger is vulnerable and other versions may be affected as well.

As a workaround, Symantec suggested users disable active scripting in Internet Explorer or set the kill bit on CLSID:24F3EAD6-8B87-4C1A-97DA-71C126BDA08F.

Dig Deeper on Social media security risks

Start the conversation

Send me notifications when other members comment.

Please create a username to comment.