'Critical security hole' found in AOL IM

Two security companies have both claimed that AOL's Instant Messenger application contains a serious vulnerability that could allow malicious hackers to take control of a user's PC.

According to Secunia and Internet Security Systems, there is a flaw in the "away" function of AOL IM, which allows users to show their friends that they're not at their computer.

"The vulnerability is caused due to a boundary error within the handling of 'Away' messages and can be exploited to cause a stack-based buffer overflow by supplying an overly long 'Away' message (about 1,024 bytes). A malicious Web site can exploit this via the 'aim:' URI handler by passing an overly long argument to the 'goaway?message' parameter," reported Secunia. Secunia described the vulnerability as "highly critical".

Once the buffer overflow has been executed a malicious hacker could then direct the client PC to a Web site where more code could be downloaded.

Secunia has said that an updated version of AOL IM that isn't vulnerable to this flaw will be made available, but no details of this were visible on AOL's Web site at the time of writing.

AOL UK was not immediately able to supply more information.