Secunia

A vulnerability has been discovered in AOL Instant Messenger, which can be exploited by malicious people to execute arbitrary script code.

Input passed to the AIM client via an IM message is not properly sanitised before being displayed to the user in e.g. a message window or Notification window. This can be exploited to e.g. execute arbitrary script code in the Local Zone (My Computer) context by sending a specially crafted IM message to another user.

NOTE: The Notification window vector only allows for a limited amount of script code to be executed.

The vulnerability is reported in versions 6.1.41.2, 6.2.32.1, AIM Pro, and AIM Lite, and is confirmed in version 6.1.41.2 for the Notification window vector. Other versions may also be affected.

Solution
Update to version 6.5.
Further details available in Customer Area

Provided and/or discovered by
* Shell and Lone (Notification window vector)
* Lucas Lavarello, CORE Security Consulting Services

Changelog
Further details available in Customer Area

Original Advisory
CORE Security:
http://www.coresecurity.com/index.php5?module=ContentMod&action=item&id=1924

Alternate/detailed remediation
Further details available in Customer Area

Deep Links
Links available in Customer Area