Jump to content
Search In
  • More options...
Find results that contain...
Find results in...
Sign in to follow this  
DITDxCULT

Hole in AIM??

Recommended Posts

http://www.cnn.com/2002/TECH/ptech/01/02/a...rity/index.html

 

 

------------------------------------------------------------------------

 

------------------------------------------------------------------------

 

RESTON, Virginia (CNN) -- AOL Time Warner's popular AOL Instant Messenger has a security flaw that could enable a hacker to invade a user's computer and wreak havoc on the system, the company and a security group said Wednesday.

 

AOL spokesman Andrew Weinstein said there have been no indications that hackers have exploited the flaw, which should be fixed by Thursday or Friday. AOL Time Warner is the parent company of CNN.com

 

"This is more of a theoretical issue because we don't believe this has actually occurred," Weinstein said. "We have developed a resolution, and it should be deployed in a day or two."

 

He described the fix as a "server-side resolution" that AOL would repair itself, so "users won't have to do anything" to fix the problem.

 

The problem has to do with a new feature that allows users to play online games with each other. The security flaw appears only in its most recent Windows version of AIM, 4.7, Weinstein said.

 

The group that discovered the flaw says it dates back to at least the 4.3 version. The group, w00w00, is a nonprofit security organization that has members in nine countries, including Russia, the United States and Australia.

 

Non-Windows versions are not affected by the problem.

 

Until AOL fixes the problem, w00w00 recommends users restrict incoming messages to friends on their "Buddy List." A user can do this by going to "Your Preferences." In the "Privacy" section, click "Allow Only Users on My Buddy List" under "Who Can Contact Me," the security group said.

 

Not taking such an action would leave the program vulnerable to a worm or virus similar to Melissa, ILOVEYOU and Code Red, which have caused problems in computers worldwide.

 

The flaw is "relatively simple to exploit."

 

"The implications of this vulnerability are huge and leave the door wide open for a worm," w00w00 said in a statement on its Web site. "This vulnerability will allow remote penetration of the victim's system without any indication as to who performed the attack. There is no opportunity to refuse the request."

 

AIM has more than 100 million users on its various versions.

Share this post


Link to post
Share on other sites

Register for a 12ozProphet forum account or sign in to comment

You need to be a forum member in order to comment. Forum accounts are separate from shop accounts.

Create an account

Register to become a 12ozProphet forum member.

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
Sign in to follow this  

×