Software Engineering Institute

There is a vulnerability in the installer for AOL Instant Messenger (AIM) that silently adds "http://free.aol.com" to the list of Trusted Sites in Microsoft's Internet Explorer (MSIE). The default security level for the Trusted Sites Zone is "Low". According to the description in the MSIE Internet Options dialog, the "Low" security level has the following properties:

- Minimal safeguards and warning prompts are provided
- Most content is downloaded and run without prompts
- All active content can run
- Appropriate for sites that you absolutely trust

This vulnerability weakens the security settings of affected hosts, thus increasing the likelihood that a remote attacker can execute arbitrary code on behalf of the victim.

The CERT/CC is currently unaware of a practical solution to this problem.

Remove the URL from the list of Trusted Sites

Affected users can remove "http://free.aol.com" from the list of Trusted Sites in Internet Explorer by taking the following actions:

- Select "Tools... Internet Options..." from the menu bar
- Click on the "Security" tab
- Select the "Trusted Sites" icon
- Click the "Sites..." button
- Select "http://free.aol.com" from the box labeled "Web sites:" and click the "Remove" button

Please note that subsequent installation of AIM will cause the URL to be added again.