Secunia

A weakness has been identified in ICQ, which potentially can be exploited in combination with known browser vulnerabilities and functionality to compromise users' systems.

The problem is that ICQ sound scheme (.scm) files creates wave (.wav) files in the "Sounds" sub folder of the ICQ folder with arbitrary names. It is possible for malicious websites to control the content of the wave files.

This can be exploited to place malicious content in a predictable file on a user's system. Combined with certain known browser vulnerabilities and functionality, which allows arbitrary files on a user's system to be read, this may allow execution of script code in context of the "My Computer" security zone.

This is known to be exploited by the Bizex worm.

NOTE: This issue has been rated "Not critical" because the issue in itself doesn't pose a security risk unless e.g. combined with the vulnerabilities and inappropriate functionality in Internet Explorer.

For more information:
SA10523

Solution
Disable active scripting support in Internet Explorer for all zones including "My Computer" and enable it only for trusted sites.

Provided and/or discovered by
This appears to be the same issue as reported by Jelmer in 2002.

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area