Software Engineering Institute

AOL Instant Messenger has the ability to embed images into an instant message. However, if the graphic is not a valid image then an icon will be displayed showing the file type and the image data is saved to the log file. The images are saved in a the following format:

<BINARY><STYLE><DATA ID="1" SIZE="66">Data that would be inside the image</DATA></STYLE></BINARY>

If you were to send an HTML file which included malicious script/HTML code with a image extension that started with </DATA></STYLE></BINARY>, then the script/HTML would be interpreted if logs were saved and viewed with an html browser.

In some Alpha versions of AIM versions 4.4 and later, that were leaked, logs are saved by default to C:\AimLogs\Username\IMLog.htm, and while AIM has a utility to view the logs, clicking directly on the file will launch the victim's default web browser to view it. If you do not have a leaked Alpha version, then you will not be vulnerable to this issue.

An attacker can execute arbitrary script/HTML on the victims machine when the logs are viewed with a web browser.

Upgrade to AIM version 4.7, or any other non-leaked version, which has logging disabled.

Do not use pre-production alpha's, especially ones that have been leaked/stolen. Open the logs in a text-only viewer. You can also configure AIM to not accept any image connections. Additionally, AIM versions 4.4 or higher that support logging, also included a Log Manager. Use the Log Manager to view log files.